Merge pull request 'feat: add jupyterhub role' (#173) from neoloc/jupyterhub into develop

Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/173

hieradata/roles/apps/jupyter/hub.yaml

@@ -0,0 +1,45 @@
+---
+profiles::packages::include:
+  python3.12: {}
+  python3.12-pip: {}
+
+hiera_include:
+  - profiles::nginx::simpleproxy
+
+# manage a simple nginx reverse proxy
+profiles::nginx::simpleproxy::nginx_vhost: 'jupyterhub.query.consul'
+profiles::nginx::simpleproxy::nginx_aliases:
+  - jupyterhub.service.consul
+  - jupyterhub.query.consul
+  - "jupyterhub.service.%{facts.country}-%{facts.region}.consul"
+
+profiles::nginx::simpleproxy::proxy_port: 8000
+profiles::nginx::simpleproxy::proxy_path: '/'
+nginx::client_max_body_size: 20M
+
+# additional altnames
+profiles::pki::vault::alt_names:
+  - jupyterhub.service.consul
+  - jupyterhub.query.consul
+  - "jupyterhub.service.%{facts.country}-%{facts.region}.consul"
+
+# configure consul service
+consul::services:
+  jupyterhub:
+    service_name: 'jupyterhub'
+    tags:
+      - 'jupyterhub'
+    address: "%{facts.networking.ip}"
+    port: 443
+    checks:
+      - id: 'jupyterhub_http_check'
+        name: 'jupyterhub HTTP Check'
+        http: "https://%{facts.networking.fqdn}"
+        method: 'GET'
+        tls_skip_verify: true
+        interval: '10s'
+        timeout: '1s'
+profiles::consul::client::node_rules:
+  - resource: service
+    segment: jupyterhub
+    disposition: write

hieradata/roles/infra/auth/glauth.yaml

@@ -63,6 +63,7 @@ glauth::users:
       - 20018
       - 20023
       - 20024
+      - 20025
     loginshell: '/bin/bash'
     homedir: '/home/benvin'
     passsha256: 'd2434f6b4764ef75d5b7b96a876a32deedbd6aa726a109c3f32e823ca66f604a'
@@ -294,3 +295,9 @@ glauth::groups:
   vault_admin:
     group_name: 'vault_admin'
     gidnumber: 20024
+  jupyterhub_admin:
+    group_name: 'jupyterhub_admin'
+    gidnumber: 20025
+  jupyterhub_user:
+    group_name: 'jupyterhub_user'
+    gidnumber: 20026