# Obtener las fuentes del kernel
cd /usr/src/
wget https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.2.tar.xz
tar -xvf linux-6.2.tar.xz
cd linux-6.2/

# Configurar el kernel (basado en la configuración actual)
cp /boot/config-$(uname -r) .config
make menuconfig

# Compilar el kernel (utilizando todos los núcleos disponibles)
make -j $(nproc)

# Instalar módulos y kernel
make modules_install
make install

# Actualizar grub
update-grub

# /etc/sysctl.conf - Optimización para servidor web de alto tráfico

# Incrementar límites de conexiones TCP
net.core.somaxconn = 65535
net.ipv4.tcp_max_syn_backlog = 65535
net.core.netdev_max_backlog = 65535

# Reutilización de sockets en TIME_WAIT
net.ipv4.tcp_tw_reuse = 1

# Protección contra ataques SYN flood
net.ipv4.tcp_syncookies = 1

# Incrementar el espacio de buffer de recepción/envío
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216

# Optimizar el uso de memoria del sistema
vm.swappiness = 10
vm.dirty_ratio = 60
vm.dirty_background_ratio = 2

# Aplicar cambios
sysctl -p

# Ver estadísticas detalladas del kernel
vmstat 1
iostat -xz 1
mpstat -P ALL 1

# Analizar llamadas al sistema
strace -p <PID>

# Monitorizar eventos del kernel en tiempo real
perf top

# Crear un RAID 10 con 4 discos
mdadm --create /dev/md0 --level=10 --raid-devices=4 /dev/sdb /dev/sdc /dev/sdd /dev/sde

# Verificar el estado del RAID
cat /proc/mdstat
mdadm --detail /dev/md0

# Crear sistema de archivos en el RAID
mkfs.xfs /dev/md0

# Configurar montaje automático
echo '/dev/md0 /data xfs defaults 0 0' >> /etc/fstab

# Guardar configuración de RAID
mdadm --detail --scan >> /etc/mdadm/mdadm.conf

# Crear volúmenes físicos
pvcreate /dev/sdb /dev/sdc

# Crear grupo de volúmenes
vgcreate vg_data /dev/sdb /dev/sdc

# Crear volumen lógico
lvcreate -n lv_data -L 500G vg_data

# Ampliar un volumen lógico en caliente
lvextend -L +100G /dev/vg_data/lv_data
xfs_growfs /data  # Para XFS
resize2fs /dev/vg_data/lv_data  # Para ext4

# /etc/network/interfaces - Configuración de bonding
auto bond0
iface bond0 inet static
    address 192.168.1.10
    netmask 255.255.255.0
    gateway 192.168.1.1
    dns-nameservers 8.8.8.8 8.8.4.4
    bond-slaves eno1 eno2
    bond-mode 802.3ad
    bond-miimon 100
    bond-downdelay 200
    bond-updelay 200
    bond-lacp-rate 1

# /etc/sysconfig/network-scripts/ifcfg-bond0
DEVICE=bond0
TYPE=Bond
NAME=bond0
BONDING_MASTER=yes
BOOTPROTO=none
ONBOOT=yes
IPADDR=192.168.1.10
NETMASK=255.255.255.0
GATEWAY=192.168.1.1
BONDING_OPTS="mode=4 miimon=100 lacp_rate=1"

# /etc/sysconfig/network-scripts/ifcfg-eno1
DEVICE=eno1
TYPE=Ethernet
BOOTPROTO=none
ONBOOT=yes
MASTER=bond0
SLAVE=yes

# /etc/sysconfig/network-scripts/ifcfg-eno2
DEVICE=eno2
TYPE=Ethernet
BOOTPROTO=none
ONBOOT=yes
MASTER=bond0
SLAVE=yes

# Instalar Open vSwitch
apt install openvswitch-switch

# Crear un puente virtual
ovs-vsctl add-br ovs-br0

# Añadir puertos físicos al puente
ovs-vsctl add-port ovs-br0 eno1

# Configurar VLAN
ovs-vsctl add-port ovs-br0 vlan10 tag=10 -- set interface vlan10 type=internal

# Configurar el puerto interno
ip addr add 192.168.10.1/24 dev vlan10
ip link set vlan10 up

# Configuración básica de firewall con nftables
cat > /etc/nftables.conf <'EOF'
#!/usr/sbin/nft -f

flush ruleset

table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;
        
        # Permitir tráfico establecido/relacionado
        ct state established,related accept
        
        # Permitir loopback
        iifname lo accept
        
        # Permitir ICMP/ICMPv6
        ip protocol icmp accept
        ip6 nexthdr icmpv6 accept
        
        # Permitir SSH
        tcp dport 22 accept
        
        # Permitir HTTP/HTTPS
        tcp dport { 80, 443 } accept
        
        # Registrar paquetes rechazados
        log prefix "nftables rejected: " counter drop
    }
    
    chain forward {
        type filter hook forward priority 0; policy drop;
    }
    
    chain output {
        type filter hook output priority 0; policy accept;
    }
}
EOF

# Activar configuración
nft -f /etc/nftables.conf

# Habilitar servicio
systemctl enable nftables
systemctl start nftables

# Crear un cgroup para limitar recursos de una aplicación
mkdir -p /sys/fs/cgroup/memory/myapp
echo "512M" > /sys/fs/cgroup/memory/myapp/memory.limit_in_bytes
echo "1G" > /sys/fs/cgroup/memory/myapp/memory.memsw.limit_in_bytes

# Limitar CPU
mkdir -p /sys/fs/cgroup/cpu/myapp
echo "512" > /sys/fs/cgroup/cpu/myapp/cpu.shares

# Añadir un proceso al cgroup
echo $PID > /sys/fs/cgroup/memory/myapp/cgroup.procs
echo $PID > /sys/fs/cgroup/cpu/myapp/cgroup.procs

# Crear un archivo unit para el servicio con límites
cat > /etc/systemd/system/myapp.service <'EOF'
[Unit]
Description=Mi Aplicación
After=network.target

[Service]
ExecStart=/usr/local/bin/myapp
Restart=on-failure
CPUShares=512
MemoryLimit=512M
MemorySwapMax=1G

[Install]
WantedBy=multi-user.target
EOF

# Recargar systemd y habilitar servicio
systemctl daemon-reload
systemctl enable --now myapp

# Análisis de uso de CPU por proceso
pidstat -u 1

# Análisis de uso de memoria por proceso
pidstat -r 1

# Análisis de operaciones I/O por proceso
pidstat -d 1

# Análisis detallado de uso de CPU
perf record -a -g -p $PID -- sleep 30
perf report

# Visualización de bloqueos entre procesos
pstree -pa $PID

# Análisis de tiempos de respuesta de sistema de archivos
biolatency -D 10

# Instalar herramientas bcc
apt install bpfcc-tools linux-headers-$(uname -r)

# Analizar latencia de operaciones I/O
biolatency

# Analizar llamadas al sistema por proceso
trace -p $PID 'SyS_*'

# Analizar operaciones de red
tcpconnect

# Rastrear tiempo de ejecución de funciones específicas
funclatency 'tcp_*'

# inventory.yml - Definición de hosts
all:
  children:
    webservers:
      hosts:
        web01:
          ansible_host: 192.168.1.101
        web02:
          ansible_host: 192.168.1.102
    dbservers:
      hosts:
        db01:
          ansible_host: 192.168.1.201
    
    production:
      children:
        webservers:
        dbservers:

# webserver-hardening.yml - Playbook para asegurar servidores web
---
- name: Asegurar servidores web
  hosts: webservers
  become: true
  tasks:
    - name: Actualizar todos los paquetes
      apt:
        update_cache: yes
        upgrade: dist
        
    - name: Instalar paquetes de seguridad
      apt:
        name:
          - fail2ban
          - ufw
          - rkhunter
          - auditd
        state: present
        
    - name: Configurar fail2ban
      template:
        src: templates/jail.local.j2
        dest: /etc/fail2ban/jail.local
      notify: restart fail2ban
      
    - name: Configurar firewall UFW
      ufw:
        rule: allow
        port: "{{ item }}"
        proto: tcp
      with_items:
        - 22
        - 80
        - 443
        
    - name: Habilitar UFW
      ufw:
        state: enabled
        policy: deny
        
    - name: Establecer permisos restrictivos en archivos críticos
      file:
        path: "{{ item }}"
        mode: 0600
        owner: root
        group: root
      with_items:
        - /etc/ssh/sshd_config
        - /etc/shadow
        - /etc/gshadow
        
  handlers:
    - name: restart fail2ban
      service:
        name: fail2ban
        state: restarted

# main.tf - Definición de infraestructura para servidores Linux
provider "aws" {
  region = "eu-west-1"
}

# Definir una VPC
resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
  
  tags = {
    Name = "production-vpc"
    Environment = "production"
  }
}

# Crear subred
resource "aws_subnet" "main" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.1.0/24"
  
  tags = {
    Name = "production-subnet"
  }
}

# Grupo de seguridad para servidores web
resource "aws_security_group" "web" {
  name        = "web-sg"
  description = "Permitir tráfico web"
  vpc_id      = aws_vpc.main.id

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
  
  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
  
  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# Instancia EC2 con Linux
resource "aws_instance" "web" {
  count         = 3
  ami           = "ami-0123456789abcdef0"  # Ubuntu Server 22.04 LTS
  instance_type = "t3.medium"
  subnet_id     = aws_subnet.main.id
  vpc_security_group_ids = [aws_security_group.web.id]
  
  user_data = <<-EOF
              #!/bin/bash
              apt-get update
              apt-get install -y nginx
              systemctl enable nginx
              systemctl start nginx
              EOF
  
  tags = {
    Name = "webserver-${count.index + 1}"
    Environment = "production"
    Role = "web"
  }
}

# Balanceador de carga
resource "aws_lb" "web" {
  name               = "web-lb"
  internal           = false
  load_balancer_type = "application"
  security_groups    = [aws_security_group.web.id]
  subnets            = [aws_subnet.main.id]
}

# Grupo objetivo para el balanceador
resource "aws_lb_target_group" "web" {
  name     = "web-tg"
  port     = 80
  protocol = "HTTP"
  vpc_id   = aws_vpc.main.id
}

# Adjuntar instancias al grupo objetivo
resource "aws_lb_target_group_attachment" "web" {
  count            = 3
  target_group_arn = aws_lb_target_group.web.arn
  target_id        = aws_instance.web[count.index].id
  port             = 80
}

# /etc/ssh/sshd_config
# Configuración segura de SSH

# Restricciones básicas
Protocol 2
PermitRootLogin no
PasswordAuthentication no
PermitEmptyPasswords no
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys

# Restricciones de tiempo
LoginGraceTime 30
ClientAliveInterval 300
ClientAliveCountMax 2

# Restricciones criptográficas
KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com

# Restricciones de acceso
AllowUsers usuario1 usuario2
AllowGroups sysadmin devops

# Logging
SyslogFacility AUTH
LogLevel VERBOSE

# Aplicar cambios: systemctl restart sshd

# Crear política personalizada para una aplicación web
cat > mywebapp.te <'EOF'
module mywebapp 1.0;

require {
    type httpd_t;
    type var_log_t;
    type custom_app_port_t;
    class tcp_socket name_connect;
    class file { read write open getattr };
}

# Permitir que el proceso web escriba en logs específicos
allow httpd_t var_log_t:file { read write open getattr };

# Permitir conexiones a puertos personalizados
allow httpd_t custom_app_port_t:tcp_socket name_connect;
EOF

# Compilar e instalar la política
checkmodule -M -m -o mywebapp.mod mywebapp.te
semodule_package -o mywebapp.pp -m mywebapp.mod
semodule -i mywebapp.pp

# /etc/apparmor.d/usr.local.bin.myapp
#include <tunables/global>

/usr/local/bin/myapp {
  #include <abstractions/base>
  #include <abstractions/nameservice>
  #include <abstractions/openssl>

  # Capabilities
  capability net_bind_service,
  capability setgid,
  capability setuid,

  # Archivos de la aplicación
  /usr/local/bin/myapp mr,
  /usr/local/share/myapp/** r,
  
  # Configuración
  /etc/myapp/** r,
  
  # Logs
  /var/log/myapp/ rw,
  /var/log/myapp/* rw,
  
  # Data
  /var/lib/myapp/ rw,
  /var/lib/myapp/** rwk,
  
  # Networking
  network inet stream,
  network inet6 stream,
}

# /etc/audit/rules.d/audit.rules
# Borrar reglas existentes
-D

# Establecer tamaño del buffer y backlog
-b 8192
--backlog_wait_time 0

# Monitorizar archivos de sistema críticos
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/sudoers -p wa -k sudo_config
-w /etc/sudoers.d/ -p wa -k sudo_config

# Monitorizar cambios en la configuración de red
-w /etc/network/ -p wa -k network
-w /etc/sysconfig/network -p wa -k network

# Monitorizar cambios en la configuración del sistema
-w /etc/selinux/ -p wa -k selinux
-w /etc/apparmor/ -p wa -k apparmor
-w /etc/ssh/sshd_config -p wa -k sshd_config

# Monitorizar llamadas al sistema relevantes
-a always,exit -F arch=b64 -S mount -S umount2 -S unlink -S unlinkat -S rmdir -k delete
-a always,exit -F arch=b32 -S mount -S umount -S unlink -S unlinkat -S rmdir -k delete
-a always,exit -F arch=b64 -S setuid -S setgid -S setreuid -S setregid -k perm_mod
-a always,exit -F arch=b32 -S setuid -S setgid -S setreuid -S setregid -k perm_mod

# Monitorizar accesos fallidos
-a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F exit=-EACCES -F key=access
-a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F exit=-EACCES -F key=access
-a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F exit=-EPERM -F key=access
-a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F exit=-EPERM -F key=access

# Reiniciar auditd después de cargar reglas
service auditd restart

# /etc/modprobe.d/kvm.conf
options kvm_intel nested=1
options kvm_intel emulate_invalid_guest_state=0
options kvm ignore_msrs=1
options kvm report_ignored_msrs=0

virt-install \
  --name vm01 \
  --memory 4096 \
  --vcpus 4,sockets=2,cores=2,threads=1 \
  --cpu host-passthrough \
  --disk path=/var/lib/libvirt/images/vm01.qcow2,size=50,format=qcow2,bus=virtio \
  --network bridge=br0,model=virtio \
  --graphics none \
  --console pty,target_type=serial \
  --os-variant ubuntu20.04 \
  --location http://archive.ubuntu.com/ubuntu/dists/focal/main/installer-amd64/ \
  --extra-args "console=ttyS0,115200n8"

// /etc/docker/daemon.json
{
  "storage-driver": "overlay2",
  "storage-opts": [
    "overlay2.override_kernel_check=true"
  ],
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "100m",
    "max-file": "3"
  },
  "default-ulimits": {
    "nofile": {
      "Name": "nofile",
      "Hard": 64000,
      "Soft": 64000
    }
  },
  "default-shm-size": "64M",
  "live-restore": true,
  "userland-proxy": false,
  "no-new-privileges": true,
  "metrics-addr": "0.0.0.0:9323",
  "experimental": true
}

# Configuración de kubeadm para clúster de alta disponibilidad
cat > kubeadm-config.yaml <EOF
apiVersion: kubeadm.k8s.io/v1beta2
kind: ClusterConfiguration
kubernetesVersion: v1.25.0
controlPlaneEndpoint: "kube-api.example.com:6443"
networking:
  podSubnet: 10.244.0.0/16
  serviceSubnet: 10.96.0.0/12
apiServer:
  extraArgs:
    authorization-mode: Node,RBAC
    enable-admission-plugins: NodeRestriction,PodSecurityPolicy
  timeoutForControlPlane: 4m0s
controllerManager:
  extraArgs:
    node-monitor-period: 2s
    node-monitor-grace-period: 16s
    pod-eviction-timeout: 30s
scheduler:
  extraArgs:
    address: 0.0.0.0
etcd:
  local:
    dataDir: /var/lib/etcd
    extraArgs:
      auto-compaction-retention: "1"
---
apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
cgroupDriver: systemd
systemReserved:
  cpu: 500m
  memory: 1Gi
  ephemeral-storage: 10Gi
kubeReserved:
  cpu: 500m
  memory: 1Gi
  ephemeral-storage: 10Gi
evictionHard:
  memory.available: "500Mi"
  nodefs.available: "10%"
  nodefs.inodesFree: "5%"
protectKernelDefaults: true
EOF

# Inicializar el clúster
kubeadm init --config=kubeadm-config.yaml --upload-certs

# Instalar paquetes necesarios
apt install pacemaker corosync resource-agents

# Configuración básica de corosync
cat > /etc/corosync/corosync.conf <'EOF'
totem {
  version: 2
  cluster_name: linux_cluster
  transport: udpu
  interface {
    ringnumber: 0
    bindnetaddr: 192.168.1.0
    mcastport: 5405
    ttl: 1
  }
}

nodelist {
  node {
    ring0_addr: 192.168.1.10
    nodeid: 1
  }
  node {
    ring0_addr: 192.168.1.11
    nodeid: 2
  }
  node {
    ring0_addr: 192.168.1.12
    nodeid: 3
  }
}

quorum {
  provider: corosync_votequorum
  two_node: 0
}

logging {
  to_logfile: yes
  logfile: /var/log/corosync/corosync.log
  to_syslog: yes
  timestamp: on
}
EOF

# Configurar recursos con pcs
pcs resource create virtual_ip ocf:heartbeat:IPaddr2 ip=192.168.1.100 cidr_netmask=24 op monitor interval=10s

pcs resource create web_server ocf:heartbeat:apache configfile=/etc/apache2/apache2.conf statusurl="http://localhost/server-status" op monitor interval=10s

# Configurar restricciones
pcs constraint colocation add web_server virtual_ip INFINITY
pcs constraint order virtual_ip then web_server

# /etc/filebeat/filebeat.yml
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/syslog
    - /var/log/auth.log
  fields:
    log_type: syslog
    environment: production
  fields_under_root: true

- type: log
  enabled: true
  paths:
    - /var/log/apache2/access.log
    - /var/log/apache2/error.log
  fields:
    log_type: webserver
    service: apache
  fields_under_root: true

- type: log
  enabled: true
  paths:
    - /var/log/mysql/error.log
  fields:
    log_type: database
    service: mysql
  fields_under_root: true

processors:
  - add_host_metadata: 
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

output.elasticsearch:
  hosts: ["elasticsearch.example.com:9200"]
  protocol: "https"
  username: "filebeat"
  password: "YOUR_PASSWORD"
  ssl.certificate_authorities: ["/etc/filebeat/ca.crt"]
  index: "filebeat-%{[agent.version]}-%{+yyyy.MM.dd}"

setup.kibana:
  host: "kibana.example.com:5601"
  protocol: "https"
  ssl.certificate_authorities: ["/etc/filebeat/ca.crt"]

setup.template.settings:
  index.number_of_shards: 3
  index.number_of_replicas: 1

# /etc/prometheus/prometheus.yml
global:
  scrape_interval: 15s
  evaluation_interval: 15s

alerting:
  alertmanagers:
  - static_configs:
    - targets:
      - alertmanager:9093

rule_files:
  - "rules/*.yml"

scrape_configs:
  - job_name: 'prometheus'
    static_configs:
    - targets: ['localhost:9090']

  - job_name: 'node_exporter'
    scrape_interval: 10s
    static_configs:
    - targets:
      - 'server01:9100'
      - 'server02:9100'
      - 'server03:9100'
    relabel_configs:
      - source_labels: [__address__]
        regex: '(.*):9100'
        target_label: instance
        replacement: ${1}

  - job_name: 'mysql_exporter'
    static_configs:
    - targets:
      - 'db01:9104'
      - 'db02:9104'
    relabel_configs:
      - source_labels: [__address__]
        regex: '(.*):9104'
        target_label: instance
        replacement: ${1}
      - target_label: service
        replacement: mysql

  - job_name: 'apache_exporter'
    static_configs:
    - targets:
      - 'web01:9117'
      - 'web02:9117'
    relabel_configs:
      - source_labels: [__address__]
        regex: '(.*):9117'
        target_label: instance
        replacement: ${1}
      - target_label: service
        replacement: apache

  - job_name: 'kubernetes'
    kubernetes_sd_configs:
      - role: node

# /etc/jaeger/jaeger.yml
apiVersion: jaegertracing.io/v1
kind: Jaeger
metadata:
  name: jaeger
spec:
  strategy: production
  storage:
    type: elasticsearch
    options:
      es:
        server-urls: https://elasticsearch:9200
        username: jaeger
        password: password
  ingress:
    enabled: true
    hosts:
      - jaeger.example.com
  agent:
    strategy: DaemonSet
  collector:
    replicas: 2
    resources:
      limits:
        cpu: 1
        memory: 1Gi
      requests:
        cpu: 500m
        memory: 512Mi
  query:
    replicas: 2
    resources:
      limits:
        cpu: 500m
        memory: 512Mi
      requests:
        cpu: 100m
        memory: 128Mi

# docker-compose.yml
version: '3.8'

services:
  traefik:
    image: traefik:v2.5
    command:
      - "--api.insecure=false"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.myresolver.acme.httpchallenge=true"
      - "--certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.myresolver.acme.email=admin@example.com"
      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "letsencrypt:/letsencrypt"
    networks:
      - traefik-net
    deploy:
      mode: global
      placement:
        constraints:
          - node.role == manager
      update_config:
        parallelism: 1
        delay: 10s
      restart_policy:
        condition: on-failure

  auth-service:
    image: example/auth-service:latest
    deploy:
      replicas: 3
      update_config:
        parallelism: 1
        delay: 10s
      restart_policy:
        condition: on-failure
    environment:
      - DB_HOST=postgres
      - DB_USER=auth_user
      - DB_PASSWORD_FILE=/run/secrets/db_auth_password
      - JWT_SECRET_FILE=/run/secrets/jwt_secret
    secrets:
      - db_auth_password
      - jwt_secret
    networks:
      - traefik-net
      - backend-net
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.auth.rule=Host(`auth.example.com`)"
      - "traefik.http.routers.auth.entrypoints=websecure"
      - "traefik.http.routers.auth.tls.certresolver=myresolver"
      - "traefik.http.services.auth.loadbalancer.server.port=8080"

  api-service:
    image: example/api-service:latest
    deploy:
      replicas: 5
      update_config:
        parallelism: 2
        delay: 10s
      restart_policy:
        condition: on-failure
    environment:
      - DB_HOST=postgres
      - DB_USER=api_user
      - DB_PASSWORD_FILE=/run/secrets/db_api_password
      - AUTH_SERVICE_URL=http://auth-service:8080
    secrets:
      - db_api_password
    networks:
      - traefik-net
      - backend-net
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api.rule=Host(`api.example.com`)"
      - "traefik.http.routers.api.entrypoints=websecure"
      - "traefik.http.routers.api.tls.certresolver=myresolver"
      - "traefik.http.services.api.loadbalancer.server.port=8080"

  postgres:
    image: postgres:13
    volumes:
      - postgres-data:/var/lib/postgresql/data
    environment:
      - POSTGRES_PASSWORD_FILE=/run/secrets/postgres_password
    secrets:
      - postgres_password
    networks:
      - backend-net
    deploy:
      placement:
        constraints:
          - node.labels.db == true
      restart_policy:
        condition: on-failure

  redis:
    image: redis:6
    volumes:
      - redis-data:/data
    command: redis-server --appendonly yes --requirepass $$(cat /run/secrets/redis_password)
    secrets:
      - redis_password
    networks:
      - backend-net
    deploy:
      replicas: 2
      update_config:
        parallelism: 1
        delay: 10s
      restart_policy:
        condition: on-failure

networks:
  traefik-net:
    driver: overlay
  backend-net:
    driver: overlay
    attachable: false

volumes:
  postgres-data:
  redis-data:
  letsencrypt:

secrets:
  db_auth_password:
    external: true
  db_api_password:
    external: true
  postgres_password:
    external: true
  redis_password:
    external: true
  jwt_secret:
    external: true

# flux-system/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - gotk-components.yaml
  - gotk-sync.yaml

# flux-system/gotk-sync.yaml
apiVersion: source.toolkit.fluxcd.io/v1beta1
kind: GitRepository
metadata:
  name: flux-system
  namespace: flux-system
spec:
  interval: 1m0s
  ref:
    branch: main
  secretRef:
    name: flux-system
  url: ssh://git@github.com/organization/infrastructure
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta1
kind: Kustomization
metadata:
  name: flux-system
  namespace: flux-system
spec:
  interval: 10m0s
  path: ./clusters/production
  prune: true
  sourceRef:
    kind: GitRepository
    name: flux-system
  validation: client

# Packer template para crear imagen inmutable
source "amazon-ebs" "ubuntu" {
  ami_name      = "app-server-{{timestamp}}"
  instance_type = "t3.micro"
  region        = "us-west-2"
  source_ami_filter {
    filters = {
      name                = "ubuntu/images/*ubuntu-focal-20.04-amd64-server-*"
      root-device-type    = "ebs"
      virtualization-type = "hvm"
    }
    most_recent = true
    owners      = ["099720109477"]
  }
  ssh_username = "ubuntu"
}

build {
  sources = ["source.amazon-ebs.ubuntu"]

  provisioner "shell" {
    inline = [
      "sudo apt-get update",
      "sudo apt-get install -y nginx docker.io",
      "sudo systemctl enable nginx docker"
    ]
  }
  
  provisioner "file" {
    source      = "app/"
    destination = "/tmp/app"
  }
  
  provisioner "shell" {
    inline = [
      "sudo mv /tmp/app /opt/app",
      "sudo chown -R root:root /opt/app",
      "sudo docker build -t myapp:latest /opt/app",
      "sudo docker save myapp:latest > /opt/myapp.tar"
    ]
  }
}