terraform/CHANGELOG.md

Changelog

0.2.0 (2025-08-11)

Added

• Add 2martens realm (2a20d3d)
• Add admin group (dfb22ba)
• Add ArgoCDAdmins group (d1af8fc)
• Add certificate volume to each manager node (d41d2cc)
• Add client for ArgoCD in monitoring cluster (d047b7a)
• Add client for ArgoCD test cluster (e287e89)
• Add domain-test for testing INWX changes (82def8f)
• Add Gitea client (af646cc)
• Add group membership mapper and groups claim and scope (884accd)
• Add Keycloak provider (d7676a4)
• Add module for docker-network (WIP) (fc52f66)
• Add nameserver resource (729960b)
• Add swarm cluster for test stage (d76f375)
• Add tsw-timetable-frontend client and update CSP (1a9dc2f)
• Add wahlrecht client (e2217b7)
• Add wahlrecht client (6255bc5)
• Create grafana client (e3ca8ca)
• Setup GitHub as identity provider (4e8bdbf)

Changed

• Add admin user to docker group (3e31f54)
• Add certbot renewal cronjob (06bbac8)
• Add domain zone on nameserver (7cf1e3a)
• Add labels to load balancer (7339228)
• Add output swarm_nodes (2c54e21)
• Add outputs for all worker nodes as well (8a4f2c6)
• Add rdns for load balancer (f9a0305)
• Add role mapper for view-profile to timetable frontend (adc9dac)
• Add services for load balancer and move configuration into separate file (c76e7a2)
• Add support for manager and worker nodes in Docker swarm (eba8edf)
• Add timetable roles to token (4fa8671)
• Add two roles for active/personal plan (3d86b0b)
• Create /var/www/certbot on every manager node (1abc318)
• Enable refresh tokens for grafana and switch to PUBLIC with pkce (2025eb8)
• Extract port 80/443 to separate firewalls (eba8edf)
• Import account and view-profile (adc9dac)
• Only install certbot on main manager node (d51e870)
• Only install certbot on manager nodes (141c993)
• Provide output about loadbalancer (9d2e0d1)
• Remove 2martens.eu from domain test (6ef68f4)
• Remove admin group (d72f58a)
• Remove authorization from wahlrecht (240eab6)
• Remove devops resource (0710876)
• Remove monitoring and test cluster (18fafac)
• Remove private network for load balancer (5c70a1f)
• Remove resource that changes every time and isn't productive anyway (fc8244c)
• Remove volume (3a6b841)
• Set up certsync on renewal (3a6b841)
• Use 2martens.example for domain test (6ef68f4)
• Use plus for web origin (e990c3e)
• Use public ip for targets (2d43a1b)
• Use test instance of inwx (8b34a7f)

Fixed

• Add authorization support to wahlrecht backend client (811ad23)
• Add certbot package (fa5832d)
• Add client roles to grafana (cb6f553)
• Add debug output of rsync (578c0a0)
• Add docker group (e3710c3)
• Add github user to allowed SSH users (0d96b77)
• Add localhost:4200 as allowed frame ancestors (8bdfe8b)
• Add missing path to template file (1c2e906)
• Add missing records (e2c439d)
• Add missing redirect urls (8a8fd21)
• Add missing setup for known hosts (93e3872)
• Add missing steps to complete certificate sync (0cf6717)
• Add missing variables (03daaec)
• Add rule to allow port 2377 to the private node ip (f02f9d1)
• Add rules to allow traffic for the overlay network (3f80ccd)
• Add user for GitHub Actions (ece3a51)
• Allow login redirect uri (45953eb)
• Avoid duplicate resources (e00cbe1)
• Change argocd-test-oauth client to CONFIDENTIAL (b703b43)
• Consider count for output (d23e3c1)
• Copy the entire letsencrypt directory (8086d6e)
• Disable full path of group mapper (c85371b)
• Disable full scope for all clients (f8b78b6)
• Don't change values of full scope allowed and use refresh tokens (7052c93)
• Fix duplicate name (236085d)
• Limit ports to appropriate protocols (76acc6e)
• Make sure load balancer does not terminate TLS (8a9691d)
• Move whois_protection to domain (7514828)
• Open port 2377 only on manager nodes (18a1d1e)
• Provide only location (abfd364)
• Reference correct file (ebdb3ef)
• Remove all K8s related resources (0a851ca)
• Remove certbot renewal (04c9671)
• Remove duplicate variable declaration (5f5bfd3)
• Remove inwx_nameserver as that breaks the apply (47004e4)
• Remove no longer required microk8s group (cf87dba)
• Remove not required variables for domain test (927eaad)
• Remove outputs from domain-test (1b7969b)
• Remove SOA records and add zone for 2martens.eu (2383874)
• Remove useless redirect uri (3a0fa35)
• Remove WHOIS protection (2e0fa2e)
• Removed invalid fields (a36372d)
• Removed resources for SOA and NS (87b5436)
• Switch back to live system for terraform folder (056e709)
• Ternary expression does not allow linebreak (b3c0d68)
• Update CSP and add valid redirect uris (b006cc4)
• Use 2martens.cloud (6f45439)
• Use allowed realm name (8a799fe)
• Use correct domain for nameserver records (9d40e26)
• Use correct ip for load balancer (0d6ffcc)
• Use correct NS for test (6ef68f4)
• Use correct syntax (a96bdd9)
• Use element function for its index overshoot capability (90de644)
• Use existing options (cdfbc13)
• Use localhost:4200 as allowed redirect url (801ae0c)
• Use twomartens as realm (31bf728)
• Use unique name for nameserver entry (b9ee24b)

Security

• Enable PKCE for timetable frontend (c6595c2)
• Enable PKCE for wahlrecht frontend (0c1fade)
• Revoke refresh tokens on first use and prevent duplicate authenticator registrations (5569c38)

0.1.0 (2024-02-05)

Added

• Add monitoring cluster (4a09d2a)

Fixed

• Allow hcloud as namespace (fe0442e)
• Allow timetable namespace for vault (ab8ee17)