Bind consul on all interfaces to fix issues with nodes finding each other. Also expose traefik to make diagnostics of issues easier.

1-nixos-node/configuration.nix

@@ -47,14 +47,12 @@
         client = {
           enabled = true;
           host_volume = {
-            traefik = {
-              path = "/opt/traefik";
-              read_only = false;
-            };
-            postgres = {
-              path = "/opt/postgres";
+%{ for volume in host_volumes ~}
+            ${volume} = {
+              path = "/opt/${volume}";
               read_only = false;
             };
+%{ endfor ~}
           };
           cni_path = "$${pkgs.cni-plugins}/bin";
         };
@@ -71,6 +69,7 @@
       interface.bind = "${bind_interface}";
       interface.advertise = "${bind_interface}";
       extraConfig  = {
+        client_addr = "{{ GetPrivateInterfaces | exclude \"type\" \"ipv6\" | join \"address\" \" \" }} {{ GetAllInterfaces | include \"flags\" \"loopback\" | join \"address\" \" \" }}";
 %{if bootstrap ~}
         bootstrap_expect = 1;
 %{endif ~}
@@ -93,21 +92,21 @@
   systemd.tmpfiles.rules = [
     # Fix issue where nomad needs alloc_mounts to be writable
     "d /var/lib/alloc_mounts 0755 root root -"
-    # Create a directory for Traefik to store its data (tls certs, etc.)
-    "d /opt/traefik 0755 root root -"
-    # Create a directory for Postgres to store its data
-    "d /opt/postgres 0755 root root -"
+%{ for volume in host_volumes ~}
+    # Create a directory for ${volume} to store its data
+    "d /opt/${volume} 0755 root root -"
+%{ endfor ~}
   ];
 
   # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.
-  networking.firewall.allowedTCPPorts = [ 80 443 4646 4647 4648 8300 8301 ];
+  networking.firewall.allowedTCPPorts = [ 80 443 8081 4646 4647 4648 8300 8301 ];
   networking.firewall.allowedUDPPorts = [ 8301 ];
 
   # Copy the NixOS configuration file and link it from the resulting system
   # (/run/current-system/configuration.nix). This is useful in case you
   # accidentally delete configuration.nix.
   system.copySystemConfiguration = true;
-
+ 
   # Defines the initial NixOS version for compatibility with older application data.
   # Do NOT change this value after installation without careful consideration.
   system.stateVersion = "24.11"; # Did you read the comment?

1-nixos-node/node.tf

@@ -14,12 +14,13 @@ terraform {
 provider "template" {}
 
 variable "nodes" {
-  description = "Map of nodes with host, password, and bind interface"
+  description = "Map of nodes with host, password, bind interface, and host volumes"
   type = map(object({
     host           = string
     password       = string
     bind_interface = string
     bootstrap      = optional(bool, false) # Optional field for bootstrap nodes
+    host_volumes   = list(string)
   }))
 }
 
@@ -29,6 +30,7 @@ locals {
       hostname       = v.host
       bind_interface = v.bind_interface
       bootstrap      = v.bootstrap
+      host_volumes   = v.host_volumes
     })
   }
 }

1-nixos-node/terraform.tfstate

@@ -1,7 +1,7 @@
 {
   "version": 4,
   "terraform_version": "1.11.4",
-  "serial": 231,
+  "serial": 251,
   "lineage": "db7dcf21-a255-0ec4-c8b8-d4a7559b3768",
   "outputs": {},
   "resources": [
@@ -15,9 +15,9 @@
           "index_key": "jaglan-beta-m01",
           "schema_version": 0,
           "attributes": {
-            "id": "822625592985314692",
+            "id": "6048275408611354621",
             "triggers": {
-              "configuration_content": "{ config, lib, pkgs, ... }:\n{\n  imports =\n    [ # Include the results of the hardware scan.\n      ./hardware-configuration.nix\n    ];\n\n  nixpkgs.config.allowUnfree = true;\n\n  # Use the systemd-boot EFI boot loader.\n  boot.loader.systemd-boot.enable = true;\n  boot.loader.efi.canTouchEfiVariables = true;\n\n  networking.hostName = \"jaglan-beta-m01\"; # Define your hostname.\n\n  time.timeZone = \"Australia/Melbourne\";\n\n  # List packages installed in system profile. To search, run:\n  # $ nix search wget\n  # environment.systemPackages = with pkgs; [\n  #   vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n  #   wget\n  # ];\n\n  # Some programs need SUID wrappers, can be configured further or are\n  # started in user sessions.\n  # programs.mtr.enable = true;\n  # programs.gnupg.agent = {\n  #   enable = true;\n  #   enableSSHSupport = true;\n  # };\n\n  # List services that you want to enable:\n  services = {\n    nomad = {\n      enable = true;\n      enableDocker = true;\n      dropPrivileges = false;\n      settings = {\n        datacenter = \"jaglan-beta\";\n        server = {\n          enabled = true;\n          bootstrap_expect = 1;\n        };\n        client = {\n          enabled = true;\n          host_volume = {\n            traefik = {\n              path = \"/opt/traefik\";\n              read_only = false;\n            };\n            postgres = {\n              path = \"/opt/postgres\";\n              read_only = false;\n            };\n          };\n          cni_path = \"${pkgs.cni-plugins}/bin\";\n        };\n        plugin.docker.config.allow_privileged = true;\n      };\n      extraPackages = with pkgs; [\n        cni-plugins\n        consul\n      ];\n    };\n    consul = {\n      enable = true;\n      webUi = true;\n      interface.bind = \"eno1\";\n      interface.advertise = \"eno1\";\n      extraConfig  = {\n        bootstrap_expect = 1;\n        server = true;\n        retry_join = [\n          \"jaglan-beta-m01\"\n          \"jaglan-beta-m20\"\n        ];\n        #client_addr = \"127.0.0.1 192.168.1.235\";\n        datacenter = \"jaglan-beta\";\n        connect.enabled = true;\n        ports.grpc = 8502;\n      };\n    };\n    openssh = {\n      enable = true;\n      settings.PermitRootLogin = \"yes\";\n    };\n  };\n\n  systemd.tmpfiles.rules = [\n    # Fix issue where nomad needs alloc_mounts to be writable\n    \"d /var/lib/alloc_mounts 0755 root root -\"\n    # Create a directory for Traefik to store its data (tls certs, etc.)\n    \"d /opt/traefik 0755 root root -\"\n    # Create a directory for Postgres to store its data\n    \"d /opt/postgres 0755 root root -\"\n  ];\n\n  # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n  networking.firewall.allowedTCPPorts = [ 80 443 4646 4647 4648 8300 8301 ];\n  networking.firewall.allowedUDPPorts = [ 8301 ];\n\n  # Copy the NixOS configuration file and link it from the resulting system\n  # (/run/current-system/configuration.nix). This is useful in case you\n  # accidentally delete configuration.nix.\n  system.copySystemConfiguration = true;\n\n  # Defines the initial NixOS version for compatibility with older application data.\n  # Do NOT change this value after installation without careful consideration.\n  system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n"
+              "configuration_content": "{ config, lib, pkgs, ... }:\n{\n  imports =\n    [ # Include the results of the hardware scan.\n      ./hardware-configuration.nix\n    ];\n\n  nixpkgs.config.allowUnfree = true;\n\n  # Use the systemd-boot EFI boot loader.\n  boot.loader.systemd-boot.enable = true;\n  boot.loader.efi.canTouchEfiVariables = true;\n\n  networking.hostName = \"jaglan-beta-m01\"; # Define your hostname.\n\n  time.timeZone = \"Australia/Melbourne\";\n\n  # List packages installed in system profile. To search, run:\n  # $ nix search wget\n  # environment.systemPackages = with pkgs; [\n  #   vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n  #   wget\n  # ];\n\n  # Some programs need SUID wrappers, can be configured further or are\n  # started in user sessions.\n  # programs.mtr.enable = true;\n  # programs.gnupg.agent = {\n  #   enable = true;\n  #   enableSSHSupport = true;\n  # };\n\n  # List services that you want to enable:\n  services = {\n    nomad = {\n      enable = true;\n      enableDocker = true;\n      dropPrivileges = false;\n      settings = {\n        datacenter = \"jaglan-beta\";\n        server = {\n          enabled = true;\n          bootstrap_expect = 1;\n        };\n        client = {\n          enabled = true;\n          host_volume = {\n            traefik = {\n              path = \"/opt/traefik\";\n              read_only = false;\n            };\n            postgres = {\n              path = \"/opt/postgres\";\n              read_only = false;\n            };\n          };\n          cni_path = \"${pkgs.cni-plugins}/bin\";\n        };\n        plugin.docker.config.allow_privileged = true;\n      };\n      extraPackages = with pkgs; [\n        cni-plugins\n        consul\n      ];\n    };\n    consul = {\n      enable = true;\n      webUi = true;\n      interface.bind = \"eno1\";\n      interface.advertise = \"eno1\";\n      extraConfig  = {\n        client_addr = \"{{ GetPrivateInterfaces | exclude \\\"type\\\" \\\"ipv6\\\" | join \\\"address\\\" \\\" \\\" }} {{ GetAllInterfaces | include \\\"flags\\\" \\\"loopback\\\" | join \\\"address\\\" \\\" \\\" }}\";\n        bootstrap_expect = 1;\n        server = true;\n        retry_join = [\n          \"jaglan-beta-m01\"\n          \"jaglan-beta-m20\"\n        ];\n        datacenter = \"jaglan-beta\";\n        connect.enabled = true;\n        ports.grpc = 8502;\n      };\n    };\n    openssh = {\n      enable = true;\n      settings.PermitRootLogin = \"yes\";\n    };\n  };\n\n  systemd.tmpfiles.rules = [\n    # Fix issue where nomad needs alloc_mounts to be writable\n    \"d /var/lib/alloc_mounts 0755 root root -\"\n    # Create a directory for traefik to store its data\n    \"d /opt/traefik 0755 root root -\"\n    # Create a directory for postgres to store its data\n    \"d /opt/postgres 0755 root root -\"\n  ];\n\n  # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n  networking.firewall.allowedTCPPorts = [ 80 443 8081 4646 4647 4648 8300 8301 ];\n  networking.firewall.allowedUDPPorts = [ 8301 ];\n\n  # Copy the NixOS configuration file and link it from the resulting system\n  # (/run/current-system/configuration.nix). This is useful in case you\n  # accidentally delete configuration.nix.\n  system.copySystemConfiguration = true;\n \n  # Defines the initial NixOS version for compatibility with older application data.\n  # Do NOT change this value after installation without careful consideration.\n  system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n"
             }
           },
           "sensitive_attributes": []
@@ -26,9 +26,9 @@
           "index_key": "jaglan-beta-m20",
           "schema_version": 0,
           "attributes": {
-            "id": "429768676960285091",
+            "id": "4501962519001291201",
             "triggers": {
-              "configuration_content": "{ config, lib, pkgs, ... }:\n{\n  imports =\n    [ # Include the results of the hardware scan.\n      ./hardware-configuration.nix\n    ];\n\n  nixpkgs.config.allowUnfree = true;\n\n  # Use the systemd-boot EFI boot loader.\n  boot.loader.systemd-boot.enable = true;\n  boot.loader.efi.canTouchEfiVariables = true;\n\n  networking.hostName = \"jaglan-beta-m20\"; # Define your hostname.\n\n  time.timeZone = \"Australia/Melbourne\";\n\n  # List packages installed in system profile. To search, run:\n  # $ nix search wget\n  # environment.systemPackages = with pkgs; [\n  #   vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n  #   wget\n  # ];\n\n  # Some programs need SUID wrappers, can be configured further or are\n  # started in user sessions.\n  # programs.mtr.enable = true;\n  # programs.gnupg.agent = {\n  #   enable = true;\n  #   enableSSHSupport = true;\n  # };\n\n  # List services that you want to enable:\n  services = {\n    nomad = {\n      enable = true;\n      enableDocker = true;\n      dropPrivileges = false;\n      settings = {\n        datacenter = \"jaglan-beta\";\n        server = {\n          enabled = true;\n        };\n        client = {\n          enabled = true;\n          host_volume = {\n            traefik = {\n              path = \"/opt/traefik\";\n              read_only = false;\n            };\n            postgres = {\n              path = \"/opt/postgres\";\n              read_only = false;\n            };\n          };\n          cni_path = \"${pkgs.cni-plugins}/bin\";\n        };\n        plugin.docker.config.allow_privileged = true;\n      };\n      extraPackages = with pkgs; [\n        cni-plugins\n        consul\n      ];\n    };\n    consul = {\n      enable = true;\n      webUi = true;\n      interface.bind = \"ens2\";\n      interface.advertise = \"ens2\";\n      extraConfig  = {\n        server = true;\n        retry_join = [\n          \"jaglan-beta-m01\"\n          \"jaglan-beta-m20\"\n        ];\n        #client_addr = \"127.0.0.1 192.168.1.235\";\n        datacenter = \"jaglan-beta\";\n        connect.enabled = true;\n        ports.grpc = 8502;\n      };\n    };\n    openssh = {\n      enable = true;\n      settings.PermitRootLogin = \"yes\";\n    };\n  };\n\n  systemd.tmpfiles.rules = [\n    # Fix issue where nomad needs alloc_mounts to be writable\n    \"d /var/lib/alloc_mounts 0755 root root -\"\n    # Create a directory for Traefik to store its data (tls certs, etc.)\n    \"d /opt/traefik 0755 root root -\"\n    # Create a directory for Postgres to store its data\n    \"d /opt/postgres 0755 root root -\"\n  ];\n\n  # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n  networking.firewall.allowedTCPPorts = [ 80 443 4646 4647 4648 8300 8301 ];\n  networking.firewall.allowedUDPPorts = [ 8301 ];\n\n  # Copy the NixOS configuration file and link it from the resulting system\n  # (/run/current-system/configuration.nix). This is useful in case you\n  # accidentally delete configuration.nix.\n  system.copySystemConfiguration = true;\n\n  # Defines the initial NixOS version for compatibility with older application data.\n  # Do NOT change this value after installation without careful consideration.\n  system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n"
+              "configuration_content": "{ config, lib, pkgs, ... }:\n{\n  imports =\n    [ # Include the results of the hardware scan.\n      ./hardware-configuration.nix\n    ];\n\n  nixpkgs.config.allowUnfree = true;\n\n  # Use the systemd-boot EFI boot loader.\n  boot.loader.systemd-boot.enable = true;\n  boot.loader.efi.canTouchEfiVariables = true;\n\n  networking.hostName = \"jaglan-beta-m20\"; # Define your hostname.\n\n  time.timeZone = \"Australia/Melbourne\";\n\n  # List packages installed in system profile. To search, run:\n  # $ nix search wget\n  # environment.systemPackages = with pkgs; [\n  #   vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n  #   wget\n  # ];\n\n  # Some programs need SUID wrappers, can be configured further or are\n  # started in user sessions.\n  # programs.mtr.enable = true;\n  # programs.gnupg.agent = {\n  #   enable = true;\n  #   enableSSHSupport = true;\n  # };\n\n  # List services that you want to enable:\n  services = {\n    nomad = {\n      enable = true;\n      enableDocker = true;\n      dropPrivileges = false;\n      settings = {\n        datacenter = \"jaglan-beta\";\n        server = {\n          enabled = true;\n        };\n        client = {\n          enabled = true;\n          host_volume = {\n          };\n          cni_path = \"${pkgs.cni-plugins}/bin\";\n        };\n        plugin.docker.config.allow_privileged = true;\n      };\n      extraPackages = with pkgs; [\n        cni-plugins\n        consul\n      ];\n    };\n    consul = {\n      enable = true;\n      webUi = true;\n      interface.bind = \"ens2\";\n      interface.advertise = \"ens2\";\n      extraConfig  = {\n        client_addr = \"{{ GetPrivateInterfaces | exclude \\\"type\\\" \\\"ipv6\\\" | join \\\"address\\\" \\\" \\\" }} {{ GetAllInterfaces | include \\\"flags\\\" \\\"loopback\\\" | join \\\"address\\\" \\\" \\\" }}\";\n        server = true;\n        retry_join = [\n          \"jaglan-beta-m01\"\n          \"jaglan-beta-m20\"\n        ];\n        datacenter = \"jaglan-beta\";\n        connect.enabled = true;\n        ports.grpc = 8502;\n      };\n    };\n    openssh = {\n      enable = true;\n      settings.PermitRootLogin = \"yes\";\n    };\n  };\n\n  systemd.tmpfiles.rules = [\n    # Fix issue where nomad needs alloc_mounts to be writable\n    \"d /var/lib/alloc_mounts 0755 root root -\"\n  ];\n\n  # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n  networking.firewall.allowedTCPPorts = [ 80 443 8081 4646 4647 4648 8300 8301 ];\n  networking.firewall.allowedUDPPorts = [ 8301 ];\n\n  # Copy the NixOS configuration file and link it from the resulting system\n  # (/run/current-system/configuration.nix). This is useful in case you\n  # accidentally delete configuration.nix.\n  system.copySystemConfiguration = true;\n \n  # Defines the initial NixOS version for compatibility with older application data.\n  # Do NOT change this value after installation without careful consideration.\n  system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n"
             }
           },
           "sensitive_attributes": []

1-nixos-node/terraform.tfstate.backup

@@ -1,7 +1,7 @@
 {
   "version": 4,
   "terraform_version": "1.11.4",
-  "serial": 228,
+  "serial": 246,
   "lineage": "db7dcf21-a255-0ec4-c8b8-d4a7559b3768",
   "outputs": {},
   "resources": [
@@ -15,9 +15,9 @@
           "index_key": "jaglan-beta-m01",
           "schema_version": 0,
           "attributes": {
-            "id": "8713155845042122574",
+            "id": "375315072123105414",
             "triggers": {
-              "configuration_content": "{ config, lib, pkgs, ... }:\n{\n  imports =\n    [ # Include the results of the hardware scan.\n      ./hardware-configuration.nix\n    ];\n\n  nixpkgs.config.allowUnfree = true;\n\n  # Use the systemd-boot EFI boot loader.\n  boot.loader.systemd-boot.enable = true;\n  boot.loader.efi.canTouchEfiVariables = true;\n\n  networking.hostName = \"jaglan-beta-m01\"; # Define your hostname.\n\n  time.timeZone = \"Australia/Melbourne\";\n\n  # List packages installed in system profile. To search, run:\n  # $ nix search wget\n  # environment.systemPackages = with pkgs; [\n  #   vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n  #   wget\n  # ];\n\n  # Some programs need SUID wrappers, can be configured further or are\n  # started in user sessions.\n  # programs.mtr.enable = true;\n  # programs.gnupg.agent = {\n  #   enable = true;\n  #   enableSSHSupport = true;\n  # };\n\n  # List services that you want to enable:\n  services = {\n    nomad = {\n      enable = true;\n      enableDocker = true;\n      dropPrivileges = false;\n      settings = {\n        datacenter = \"jaglan-beta\";\n        server = {\n          enabled = true;\n          bootstrap_expect = 2;\n        };\n        client = {\n          enabled = true;\n          host_volume = {\n            traefik = {\n              path = \"/opt/traefik\";\n              read_only = false;\n            };\n            postgres = {\n              path = \"/opt/postgres\";\n              read_only = false;\n            };\n          };\n          cni_path = \"${pkgs.cni-plugins}/bin\";\n        };\n        plugin.docker.config.allow_privileged = true;\n      };\n      extraPackages = with pkgs; [\n        cni-plugins\n        consul\n      ];\n    };\n    consul = {\n      enable = true;\n      webUi = true;\n      interface.bind = \"eno1\";\n      interface.advertise = \"eno1\";\n      extraConfig  = {\n        bootstrap_expect = 1;\n        server = true;\n        retry_join = [\n          \"jaglan-beta-m01\"\n          \"jaglan-beta-m20\"\n        ];\n        #client_addr = \"127.0.0.1 192.168.1.235\";\n        datacenter = \"jaglan-beta\";\n        connect.enabled = true;\n        ports.grpc = 8502;\n      };\n    };\n    openssh = {\n      enable = true;\n      settings.PermitRootLogin = \"yes\";\n    };\n  };\n\n  systemd.tmpfiles.rules = [\n    # Fix issue where nomad needs alloc_mounts to be writable\n    \"d /var/lib/alloc_mounts 0755 root root -\"\n    # Create a directory for Traefik to store its data (tls certs, etc.)\n    \"d /opt/traefik 0755 root root -\"\n    # Create a directory for Postgres to store its data\n    \"d /opt/postgres 0755 root root -\"\n  ];\n\n  # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n  networking.firewall.allowedTCPPorts = [ 80 443 4646 4647 4648 8300 8301 ];\n  networking.firewall.allowedUDPPorts = [ 8301 ];\n\n  # Copy the NixOS configuration file and link it from the resulting system\n  # (/run/current-system/configuration.nix). This is useful in case you\n  # accidentally delete configuration.nix.\n  system.copySystemConfiguration = true;\n\n  # Defines the initial NixOS version for compatibility with older application data.\n  # Do NOT change this value after installation without careful consideration.\n  system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n"
+              "configuration_content": "{ config, lib, pkgs, ... }:\n{\n  imports =\n    [ # Include the results of the hardware scan.\n      ./hardware-configuration.nix\n    ];\n\n  nixpkgs.config.allowUnfree = true;\n\n  # Use the systemd-boot EFI boot loader.\n  boot.loader.systemd-boot.enable = true;\n  boot.loader.efi.canTouchEfiVariables = true;\n\n  networking.hostName = \"jaglan-beta-m01\"; # Define your hostname.\n\n  time.timeZone = \"Australia/Melbourne\";\n\n  # List packages installed in system profile. To search, run:\n  # $ nix search wget\n  # environment.systemPackages = with pkgs; [\n  #   vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n  #   wget\n  # ];\n\n  # Some programs need SUID wrappers, can be configured further or are\n  # started in user sessions.\n  # programs.mtr.enable = true;\n  # programs.gnupg.agent = {\n  #   enable = true;\n  #   enableSSHSupport = true;\n  # };\n\n  # List services that you want to enable:\n  services = {\n    nomad = {\n      enable = true;\n      enableDocker = true;\n      dropPrivileges = false;\n      settings = {\n        datacenter = \"jaglan-beta\";\n        server = {\n          enabled = true;\n          bootstrap_expect = 1;\n        };\n        client = {\n          enabled = true;\n          host_volume = {\n            traefik = {\n              path = \"/opt/traefik\";\n              read_only = false;\n            };\n            postgres = {\n              path = \"/opt/postgres\";\n              read_only = false;\n            };\n          };\n          cni_path = \"${pkgs.cni-plugins}/bin\";\n        };\n        plugin.docker.config.allow_privileged = true;\n      };\n      extraPackages = with pkgs; [\n        cni-plugins\n        consul\n      ];\n    };\n    consul = {\n      enable = true;\n      webUi = true;\n      interface.bind = \"eno1\";\n      interface.advertise = \"eno1\";\n      extraConfig  = {\n        client_addr = \"{{ GetPrivateInterfaces | exclude \\\"type\\\" \\\"ipv6\\\" | join \\\"address\\\" \\\" \\\" }} {{ GetAllInterfaces | include \\\"flags\\\" \\\"loopback\\\" | join \\\"address\\\" \\\" \\\" }}\";\n        bootstrap_expect = 1;\n        server = true;\n        retry_join = [\n          \"jaglan-beta-m01\"\n          \"jaglan-beta-m20\"\n        ];\n        datacenter = \"jaglan-beta\";\n        connect.enabled = true;\n        ports.grpc = 8502;\n      };\n    };\n    openssh = {\n      enable = true;\n      settings.PermitRootLogin = \"yes\";\n    };\n  };\n\n  systemd.tmpfiles.rules = [\n    # Fix issue where nomad needs alloc_mounts to be writable\n    \"d /var/lib/alloc_mounts 0755 root root -\"\n    # Create a directory for traefik to store its data\n    \"d /opt/traefik 0755 root root -\"\n    # Create a directory for postgres to store its data\n    \"d /opt/postgres 0755 root root -\"\n  ];\n\n  # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n  networking.firewall.allowedTCPPorts = [ 80 443 4646 4647 4648 8300 8301 ];\n  networking.firewall.allowedUDPPorts = [ 8301 ];\n\n  # Copy the NixOS configuration file and link it from the resulting system\n  # (/run/current-system/configuration.nix). This is useful in case you\n  # accidentally delete configuration.nix.\n  system.copySystemConfiguration = true;\n \n  # Defines the initial NixOS version for compatibility with older application data.\n  # Do NOT change this value after installation without careful consideration.\n  system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n"
             }
           },
           "sensitive_attributes": []
@@ -26,9 +26,9 @@
           "index_key": "jaglan-beta-m20",
           "schema_version": 0,
           "attributes": {
-            "id": "429768676960285091",
+            "id": "7569759743571304983",
             "triggers": {
-              "configuration_content": "{ config, lib, pkgs, ... }:\n{\n  imports =\n    [ # Include the results of the hardware scan.\n      ./hardware-configuration.nix\n    ];\n\n  nixpkgs.config.allowUnfree = true;\n\n  # Use the systemd-boot EFI boot loader.\n  boot.loader.systemd-boot.enable = true;\n  boot.loader.efi.canTouchEfiVariables = true;\n\n  networking.hostName = \"jaglan-beta-m20\"; # Define your hostname.\n\n  time.timeZone = \"Australia/Melbourne\";\n\n  # List packages installed in system profile. To search, run:\n  # $ nix search wget\n  # environment.systemPackages = with pkgs; [\n  #   vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n  #   wget\n  # ];\n\n  # Some programs need SUID wrappers, can be configured further or are\n  # started in user sessions.\n  # programs.mtr.enable = true;\n  # programs.gnupg.agent = {\n  #   enable = true;\n  #   enableSSHSupport = true;\n  # };\n\n  # List services that you want to enable:\n  services = {\n    nomad = {\n      enable = true;\n      enableDocker = true;\n      dropPrivileges = false;\n      settings = {\n        datacenter = \"jaglan-beta\";\n        server = {\n          enabled = true;\n        };\n        client = {\n          enabled = true;\n          host_volume = {\n            traefik = {\n              path = \"/opt/traefik\";\n              read_only = false;\n            };\n            postgres = {\n              path = \"/opt/postgres\";\n              read_only = false;\n            };\n          };\n          cni_path = \"${pkgs.cni-plugins}/bin\";\n        };\n        plugin.docker.config.allow_privileged = true;\n      };\n      extraPackages = with pkgs; [\n        cni-plugins\n        consul\n      ];\n    };\n    consul = {\n      enable = true;\n      webUi = true;\n      interface.bind = \"ens2\";\n      interface.advertise = \"ens2\";\n      extraConfig  = {\n        server = true;\n        retry_join = [\n          \"jaglan-beta-m01\"\n          \"jaglan-beta-m20\"\n        ];\n        #client_addr = \"127.0.0.1 192.168.1.235\";\n        datacenter = \"jaglan-beta\";\n        connect.enabled = true;\n        ports.grpc = 8502;\n      };\n    };\n    openssh = {\n      enable = true;\n      settings.PermitRootLogin = \"yes\";\n    };\n  };\n\n  systemd.tmpfiles.rules = [\n    # Fix issue where nomad needs alloc_mounts to be writable\n    \"d /var/lib/alloc_mounts 0755 root root -\"\n    # Create a directory for Traefik to store its data (tls certs, etc.)\n    \"d /opt/traefik 0755 root root -\"\n    # Create a directory for Postgres to store its data\n    \"d /opt/postgres 0755 root root -\"\n  ];\n\n  # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n  networking.firewall.allowedTCPPorts = [ 80 443 4646 4647 4648 8300 8301 ];\n  networking.firewall.allowedUDPPorts = [ 8301 ];\n\n  # Copy the NixOS configuration file and link it from the resulting system\n  # (/run/current-system/configuration.nix). This is useful in case you\n  # accidentally delete configuration.nix.\n  system.copySystemConfiguration = true;\n\n  # Defines the initial NixOS version for compatibility with older application data.\n  # Do NOT change this value after installation without careful consideration.\n  system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n"
+              "configuration_content": "{ config, lib, pkgs, ... }:\n{\n  imports =\n    [ # Include the results of the hardware scan.\n      ./hardware-configuration.nix\n    ];\n\n  nixpkgs.config.allowUnfree = true;\n\n  # Use the systemd-boot EFI boot loader.\n  boot.loader.systemd-boot.enable = true;\n  boot.loader.efi.canTouchEfiVariables = true;\n\n  networking.hostName = \"jaglan-beta-m20\"; # Define your hostname.\n\n  time.timeZone = \"Australia/Melbourne\";\n\n  # List packages installed in system profile. To search, run:\n  # $ nix search wget\n  # environment.systemPackages = with pkgs; [\n  #   vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n  #   wget\n  # ];\n\n  # Some programs need SUID wrappers, can be configured further or are\n  # started in user sessions.\n  # programs.mtr.enable = true;\n  # programs.gnupg.agent = {\n  #   enable = true;\n  #   enableSSHSupport = true;\n  # };\n\n  # List services that you want to enable:\n  services = {\n    nomad = {\n      enable = true;\n      enableDocker = true;\n      dropPrivileges = false;\n      settings = {\n        datacenter = \"jaglan-beta\";\n        server = {\n          enabled = true;\n        };\n        client = {\n          enabled = true;\n          host_volume = {\n          };\n          cni_path = \"${pkgs.cni-plugins}/bin\";\n        };\n        plugin.docker.config.allow_privileged = true;\n      };\n      extraPackages = with pkgs; [\n        cni-plugins\n        consul\n      ];\n    };\n    consul = {\n      enable = true;\n      webUi = true;\n      interface.bind = \"ens2\";\n      interface.advertise = \"ens2\";\n      extraConfig  = {\n        client_addr = \"{{ GetPrivateInterfaces | exclude \\\"type\\\" \\\"ipv6\\\" | join \\\"address\\\" \\\" \\\" }} {{ GetAllInterfaces | include \\\"flags\\\" \\\"loopback\\\" | join \\\"address\\\" \\\" \\\" }}\";\n        server = true;\n        retry_join = [\n          \"jaglan-beta-m01\"\n          \"jaglan-beta-m20\"\n        ];\n        datacenter = \"jaglan-beta\";\n        connect.enabled = true;\n        ports.grpc = 8502;\n      };\n    };\n    openssh = {\n      enable = true;\n      settings.PermitRootLogin = \"yes\";\n    };\n  };\n\n  systemd.tmpfiles.rules = [\n    # Fix issue where nomad needs alloc_mounts to be writable\n    \"d /var/lib/alloc_mounts 0755 root root -\"\n  ];\n\n  # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n  networking.firewall.allowedTCPPorts = [ 80 443 4646 4647 4648 8300 8301 ];\n  networking.firewall.allowedUDPPorts = [ 8301 ];\n\n  # Copy the NixOS configuration file and link it from the resulting system\n  # (/run/current-system/configuration.nix). This is useful in case you\n  # accidentally delete configuration.nix.\n  system.copySystemConfiguration = true;\n \n  # Defines the initial NixOS version for compatibility with older application data.\n  # Do NOT change this value after installation without careful consideration.\n  system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n"
             }
           },
           "sensitive_attributes": []

2-nomad-config/postgres.tf

@@ -1,5 +1,6 @@
 resource "nomad_job" "postgres" {
-  jobspec = file("postgres.nomad.hcl")
+  jobspec       = file("postgres.nomad.hcl")
+  rerun_if_dead = true
 }
 
 resource "nomad_job" "pgadmin" {
@@ -18,8 +19,7 @@ resource "nomad_variable" "postgres" {
 }
 
 provider "postgresql" {
-  #host            = "jaglan-beta-m01.othrayte.one"
-  host            = "192.168.1.235"
+  host            = "jaglan-beta-m01.lan"
   port            = 5432
   database        = "postgres"
   username        = "postgres"