DevOps Config Examples

Production-ready примеры конфигураций для Kubernetes, Terraform, Ansible и CI/CD.

Структура

terraform/
├── hetzner-k8s-cluster/     # 3 ноды + private network + firewall + floating IP
└── cloudflare-dns/          # DNS записи

ansible/
├── roles/
│   ├── angie-l4-proxy/      # L4 SNI routing (Angie)
│   ├── keepalived-failover/ # HA через VRRP + Cloud API
│   ├── kubernetes-node/     # kubelet, kubeadm
│   ├── containerd/          # container runtime
│   └── docker-devops-stack/ # GitLab + Zabbix
└── playbooks/
    ├── bootstrap-k8s.yml
    └── angie-l4-proxy.yml

kubernetes/
├── kustomize/
│   ├── base/                # deployment, hpa
│   └── overlays/production/ # prod patches
├── argocd/                  # app-of-apps pattern
├── operators/cloudnative-pg/# PostgreSQL operator
├── ingress/                 # nginx-ingress
└── helm-vendors/            # vendored charts (GitOps)
    ├── redis/
    ├── postgresql/
    ├── ingress-nginx/
    ├── cert-manager/
    ├── loki/
    └── kube-prometheus-stack/

helm-charts/
└── laravel/                 # nginx + php-fpm sidecar

dockerfiles/
├── laravel.Dockerfile       # PHP-FPM + Composer + Vite
├── nextjs.Dockerfile        # Next.js standalone
├── nextjs-monorepo.Dockerfile
├── node-simple.Dockerfile   # Node.js (npm)
├── node-microservice.Dockerfile # pnpm + turbo monorepo
├── go.Dockerfile            # Go → scratch
└── python-fastapi.Dockerfile

gitlab-ci/
└── monorepo-microservices.gitlab-ci.yml

docker-compose/
└── devops-stack/            # GitLab + Zabbix + Traefik

nextjs-observability/        # OpenTelemetry → Prometheus → Grafana
├── instrumentation.ts       # OTel SDK setup
├── metrics.ts               # Custom business metrics
├── kubernetes/
│   ├── deployment.yaml
│   ├── servicemonitor.yaml
│   └── grafana-dashboard-cm.yaml
└── grafana/dashboard.json

Terraform

Hetzner Kubernetes Cluster

cd terraform/hetzner-k8s-cluster
terraform init && terraform apply

• 3 control-plane ноды (cpx21)
• Private network 10.0.0.0/16
• Floating IP для HA
• Firewall rules
• Генерация Ansible inventory

Cloudflare DNS

cd terraform/cloudflare-dns
terraform apply -var="domain=example.com"

Ansible

Angie L4 Proxy (SNI Routing)

# playbooks/angie-l4-proxy.yml
angie_sni_routes:
  - sni: "app.example.com"
    upstream: "10.0.0.10:443"
  - sni: "api.example.com"
    upstream: "10.0.0.11:443"
  - sni: "*.example.com"
    upstream: "10.0.0.12:443"

L4 роутинг по SNI без терминации TLS. Поддержка PROXY protocol.

Keepalived HA

Unicast VRRP + автоматическое переключение Floating IP через Hetzner API.

Kubernetes Bootstrap

ansible-playbook -i inventory.ini playbooks/bootstrap-k8s.yml

Устанавливает containerd, kubelet, kubeadm на все ноды.

Helm Charts

Laravel

helm install my-app ./helm-charts/laravel \
  --set image.repository=registry/app \
  --set image.tag=v1.0.0 \
  --set ingress.host=app.example.com

• Nginx + PHP-FPM sidecar
• Migrations init container
• Queue workers
• Laravel scheduler (CronJob)
• TLS через cert-manager

Dockerfiles

Файл	Описание
laravel.Dockerfile	PHP-FPM + Composer + Vite frontend
nextjs.Dockerfile	Next.js standalone build
nextjs-monorepo.Dockerfile	Next.js в pnpm/turbo монорепо
node-simple.Dockerfile	Простой Node.js с npm
node-microservice.Dockerfile	Node.js микросервис в монорепо
go.Dockerfile	Go → scratch (минимальный образ)
python-fastapi.Dockerfile	FastAPI + Poetry

Kubernetes

Kustomize

# dev
kubectl apply -k kubernetes/kustomize/base

# prod
kubectl apply -k kubernetes/kustomize/overlays/production

ArgoCD (GitOps)

kubectl apply -f kubernetes/argocd/root-app.yaml

App-of-apps pattern — один Application управляет остальными.

CloudNativePG

kubectl apply -f kubernetes/operators/cloudnative-pg/cluster.yaml

PostgreSQL с автоматическим failover.

Helm Vendors (GitOps)

Vendored Helm charts — не зависим от внешних репозиториев.

# Vendor
helm pull bitnami/redis --version 20.6.0 --untar -d kubernetes/helm-vendors/redis/
helm pull prometheus-community/kube-prometheus-stack --version 67.4.0 --untar -d kubernetes/helm-vendors/kube-prometheus-stack/

# Install
helm install redis ./kubernetes/helm-vendors/redis/redis \
  -f kubernetes/helm-vendors/redis/values.yaml -n redis --create-namespace

helm install prometheus ./kubernetes/helm-vendors/kube-prometheus-stack/kube-prometheus-stack \
  -f kubernetes/helm-vendors/kube-prometheus-stack/values.yaml -n monitoring --create-namespace

Chart	Версия	Описание
redis	20.6.0	Bitnami Redis + Sentinel
postgresql	16.4.0	Bitnami PostgreSQL
ingress-nginx	4.12.0	Ingress controller + HPA
cert-manager	1.16.2	Let's Encrypt
loki	6.23.0	Grafana Loki (logs)
kube-prometheus-stack	67.4.0	Prometheus + Grafana + Alertmanager

GitLab CI

# monorepo с микросервисами
include:
  - local: 'gitlab-ci/monorepo-microservices.gitlab-ci.yml'

Динамические jobs для измененных сервисов.

Observability

Next.js + OpenTelemetry

Next.js → OpenTelemetry SDK → Prometheus (:9464/metrics) → Grafana

# Установка зависимостей
pnpm add @opentelemetry/sdk-node @opentelemetry/exporter-prometheus @opentelemetry/auto-instrumentations-node

# Копировать в проект
cp nextjs-observability/instrumentation.ts src/
cp nextjs-observability/metrics.ts src/lib/

# Deploy ServiceMonitor + Dashboard
kubectl apply -f nextjs-observability/kubernetes/

Метрики: RPS, latency percentiles, error rate, memory, event loop lag.

Стек

Категория	Инструменты
IaC	Terraform, Ansible
Containers	Docker, containerd
Orchestration	Kubernetes (kubeadm)
Package	Helm, Kustomize
GitOps	ArgoCD
CI/CD	GitLab CI
Database	PostgreSQL (CloudNativePG), Redis
Proxy	Angie, nginx-ingress, Traefik
TLS	cert-manager, Let's Encrypt
HA	Keepalived (VRRP)
Observability	OpenTelemetry, Prometheus, Grafana, Loki
Cloud	Hetzner, Cloudflare