Kamatera Swarm

Kamatera Cloud platform with Terraform (VM provisioning and Docker Swarm bootstrap) and Docker Compose modules. Provisions a Swarm cluster — one manager, two infra workers, two app workers — with Traefik ingress in the EU-FR datacenter.

Architecture Overview

Layer	Tool	Purpose
Provider	—	Kamatera EU-FR datacenter
Firewall	Terraform	Swarm cluster inbound/outbound rules
Resources	Terraform	Manager VM, infrastructure worker VMs, app worker VMs
Namespace	Compose	Base namespace (Traefik ingress)
Deployment	—	Production instance

---

Configuration

Includes a custom provider schema that validates Kamatera VM CPU/RAM/billing constraints, and a docker_swarm topology type with manager/worker role rules.

apiVersion: strata.huybrechts.xyz/v1
kind: configuration
meta:
  name: kamatera_swarm_config
  annotations:
    description: Kamatera Cloud platform — Terraform + Docker Swarm
  labels:
    version: "1.0.0"
  tags: [kamatera, swarm, configuration]
spec:
  # Deployment hierarchy
  layering:
    - name: environment
      description: "Deployment environment (dev, staging, prd)"
      required: true

  # Deployment properties schema — defines required properties for all deployments
  deployment:
    additional_properties: false
    properties:
      environment:
        pattern: "^(dev|staging|prd)$"
        required: true
        description: "Target environment"
    # Deployment manifest storage
    manifest:
      type: local
      path: ".strata/deployments"

  # Zones group provider regions for data residency enforcement
  zones:
    - name: eu_west
      description: "Western Europe (France, Belgium, Netherlands)"
      regions:
        - fr-par
        - be-bru
    - name: eu_central
      description: "Central Europe (Germany, Austria)"
      regions:
        - de-fra
        - at-vie

  # Remotes declare the git repositories this configuration uses
  remotes:
    - name: kamatera_swarm
      type: gitops
      repository: git@github.com:your-org/kamatera-swarm-config.git
      reference: main
      source_path: .
      deploy_path: .

  # Integrations define external tools the platform uses
  integrations:
    - name: git
      type: git
      capabilities: [repository]
      required: true
      validation:
        command: git --version
        min_version: "2.30.0"
      authentication:
        method: cli

    - name: terraform
      type: terraform
      capabilities: [infrastructure]
      required: true
      validation:
        command: terraform version
        min_version: "1.0.0"
      authentication:
        method: cli
        env_vars:
          - TERRAFORM_API_TOKEN

    - name: docker
      type: docker
      capabilities: [container]
      required: true
      validation:
        command: docker --version
        min_version: "24.0.0"
      authentication:
        method: cli

    - name: bitwarden
      type: bitwarden
      capabilities: [secrets]
      required: false
      validation:
        command: bws --version
        min_version: "0.3.0"
      endpoints:
        address: https://bitwarden.com/api
      authentication:
        method: api_key
        env_vars:
          - BWS_ACCESS_TOKEN

  # Providers define supported infrastructure providers and their resource schemas
  providers:
    - name: kamatera
      description: Kamatera Cloud Provider
      additional_regions: false
      regions:
        - name: eu-fr
          description: Europe - France
        - name: be-bru
          description: Europe - Belgium
        - name: de-fra
          description: Europe - Germany
      additional_resources: false
      resources:
        - name: virtualmachine
          category: compute
          subcategory: virtualmachine
          description: Kamatera Virtual Machine
          additional_configurations: false
          configuration:
            os_name:
              pattern: "^[A-Za-z0-9_\\-]{2,32}$"
              required: true
              description: "Operating system name"
            os_code:
              pattern: "^[A-Za-z0-9.\\- ]{2,32}$"
              required: true
              description: "Operating system version code"
            cpu_type:
              pattern: "^(A|B|P|T)$"
              required: true
              description: "CPU type: A (Availability), B (Balanced), P (Performance), T (Turbo)"
            cpu_cores:
              pattern: "^[1-9][0-9]?$"
              required: true
              description: "Number of CPU cores (1-99)"
            ram_mb:
              pattern: "^(512|1024|2048|4096|8192|16384|32768)$"
              required: true
              description: "RAM in MB"
            billing:
              pattern: "^(hourly|monthly)$"
              required: true
              description: "Billing frequency"
            disk_size:
              pattern: "^[1-9][0-9]*$"
              required: false
              description: "Optional custom disk size in GB"

  # Topologies define supported deployment topologies
  additional_topologies: false
  topologies:
    - type: docker_swarm
      description: Docker Swarm Cluster Topology
      additional_components: false
      components:
        - role: manager
          description: Docker Swarm Manager Node
          uses_module: false
          is_control: true
          required: true
          min_count: 1
          max_count: 5
        - role: worker
          description: Docker Swarm Worker Node
          uses_module: false
          is_control: false
          required: true
          min_count: 1
          max_count: 5

---

Workspace

apiVersion: strata.huybrechts.xyz/v1
kind: workspace
meta:
  name: kamatera_swarm_platform
  annotations:
    description: Kamatera Docker Swarm platform workspace
  labels:
    version: "1.0.0"
  tags: [kamatera, swarm, workspace]
spec:
  providers:
    - name: kamatera_eu_fr
      file: "@kamatera_swarm/stack/kamatera-provider-eu-fr.yaml"

  provisioners:
    - name: terraform
      provisioner: terraform
      source:
        repository: kamatera_swarm
        source_path: terraform

  topology:
    - name: kamatera_swarm
      provider: kamatera_eu_fr
      provisioner: terraform
      type: docker_swarm
      volumes:
        - name: config
          type: replicated
        - name: docs
          type: replicated
        - name: data
          type: local
        - name: logs
          type: local
        - name: serve
          type: distributed
      components:
        - resource: kamatera_vm_manager
        - resource: kamatera_vm_infra
        - resource: kamatera_vm_worker

  resources:
    - name: kamatera_vm_manager
      file: "@kamatera_swarm/stack/kamatera-res-vm-manager.yaml"
      role: manager
      count: 1
      firewalls:
        - kamatera_fw
    - name: kamatera_vm_infra
      file: "@kamatera_swarm/stack/kamatera-res-vm-infra.yaml"
      role: worker
      count: 2
      firewalls:
        - kamatera_fw
    - name: kamatera_vm_worker
      file: "@kamatera_swarm/stack/kamatera-res-vm-worker.yaml"
      role: worker
      count: 2
      firewalls:
        - kamatera_fw

  namespaces:
    - name: kamatera_ns_base
      file: "@kamatera_swarm/stack/kamatera-ns-base.yaml"

  firewalls:
    - name: kamatera_fw
      file: "@kamatera_swarm/stack/kamatera-fw-base.yaml"

---

Provider

apiVersion: strata.huybrechts.xyz/v1
kind: provider
meta:
  name: kamatera_provider_eu_fr
  annotations:
    description: Kamatera Cloud — France datacenter
  labels:
    version: "1.0.0"
  tags: [kamatera, provider]
spec:
  properties:
    type: kamatera
    region: eu-fr

---

Firewall

Declarative security rules applied to the Swarm cluster nodes.

apiVersion: strata.huybrechts.xyz/v1
kind: firewall
meta:
  name: kamatera_fw
  annotations:
    description: Firewall rules for Docker Swarm cluster
  labels:
    version: "1.0.0"
  tags: [kamatera, firewall]
spec:
  reset: true
  defaults:
    - direction: in
      permission: deny
      comment: Deny all incoming traffic by default
    - direction: out
      permission: deny
      comment: Deny all outgoing traffic by default
  allow:
    # Essential system services
    - direction: out
      proto: udp
      port: 53
      comment: DNS (UDP)
    - direction: out
      proto: tcp
      port: 53
      comment: DNS (TCP)
    - direction: out
      proto: udp
      port: 123
      comment: NTP
    - direction: in
      interface: lo
      comment: Loopback IN
    - direction: out
      interface: lo
      comment: Loopback OUT
    # Package management
    - direction: out
      proto: tcp
      port: [20, 21]
      comment: FTP
    - direction: out
      proto: tcp
      port: 11371
      comment: GPG keyserver
    # SSH, HTTP, HTTPS
    - direction: in
      proto: tcp
      port: 22
      comment: SSH
    - direction: in
      proto: tcp
      port: 80
      comment: HTTP
    - direction: in
      proto: tcp
      port: 443
      comment: HTTPS
    - direction: out
      proto: tcp
      port: 80
      comment: HTTP
    - direction: out
      proto: tcp
      port: 443
      comment: HTTPS
    - direction: out
      proto: tcp
      port: 22
      to: 10.0.0.0/23
      comment: SSH to internal nodes
    # Docker Swarm cluster communication
    - direction: in
      proto: tcp
      port: 2377
      from: 10.0.0.0/23
      comment: Swarm Control IN
    - direction: out
      proto: tcp
      port: 2377
      to: 10.0.0.0/23
      comment: Swarm Control OUT
    - direction: in
      proto: udp
      port: 4789
      from: 10.0.0.0/23
      comment: Swarm Overlay Network IN
    - direction: out
      proto: udp
      port: 4789
      to: 10.0.0.0/23
      comment: Swarm Overlay Network OUT
    - direction: in
      proto: tcp
      port: 7946
      from: 10.0.0.0/23
      comment: Swarm Discovery TCP IN
    - direction: in
      proto: udp
      port: 7946
      from: 10.0.0.0/23
      comment: Swarm Discovery UDP IN
    - direction: out
      proto: tcp
      port: 7946
      to: 10.0.0.0/23
      comment: Swarm Gossip TCP OUT
    - direction: out
      proto: udp
      port: 7946
      to: 10.0.0.0/23
      comment: Swarm Gossip UDP OUT
    # Database
    - direction: in
      proto: tcp
      port: 5432
      from: 10.0.0.0/23
      comment: Postgres IN
    - direction: out
      proto: tcp
      port: 5432
      to: 10.0.0.0/23
      comment: Postgres OUT
    # Redis
    - direction: in
      proto: tcp
      port: 6379
      from: 10.0.0.0/23
      comment: Redis IN
    - direction: out
      proto: tcp
      port: 6379
      to: 10.0.0.0/23
      comment: Redis OUT
    # GlusterFS distributed storage
    - direction: in
      proto: tcp
      port: 24007:24008
      from: 10.0.0.0/23
      comment: GlusterFS Management IN
    - direction: in
      proto: tcp
      port: 49152:49251
      from: 10.0.0.0/23
      comment: GlusterFS Bricks IN
    - direction: out
      proto: tcp
      port: 24007:24008
      to: 10.0.0.0/23
      comment: GlusterFS Management OUT
    - direction: out
      proto: tcp
      port: 49152:49251
      to: 10.0.0.0/23
      comment: GlusterFS Bricks OUT

---

Resources

Swarm Manager

apiVersion: strata.huybrechts.xyz/v1
kind: resource
meta:
  name: kamatera_vm_manager
  annotations:
    description: Kamatera Virtual Machine — Docker Swarm manager node
  labels:
    version: "1.0.0"
  tags: [kamatera, vm, manager]
spec:
  properties:
    provider_type: kamatera
    resource_type: virtualmachine
    unit_cost: 5.00 # USD per month
  configuration:
    os_name: "Ubuntu"
    os_code: "24.04 64bit"
    cpu_type: "A"
    cpu_cores: 1
    ram_mb: 1024
    billing: "hourly"
  storage:
    install_path: /opt/install/app
    disks:
      - size: 20
        label: vm-manager-os
        mount: /mnt/data1
    volumes:
      - name: config
        path: /mnt/data1/etc/app
      - name: docs
        path: /mnt/data1/var/docs/app
      - name: data
        path: /mnt/data1/var/data/app
      - name: logs
        path: /mnt/data1/var/logs/app
      - name: serve
        path: /mnt/data1/var/serve

Infrastructure Workers

apiVersion: strata.huybrechts.xyz/v1
kind: resource
meta:
  name: kamatera_vm_infra
  annotations:
    description: Kamatera Virtual Machine — Docker Swarm infrastructure node
  labels:
    version: "1.0.0"
  tags: [kamatera, vm, infra]
spec:
  properties:
    provider_type: kamatera
    resource_type: virtualmachine
    unit_cost: 11.00 # USD per month
  configuration:
    os_name: "Ubuntu"
    os_code: "24.04 64bit"
    cpu_type: "A"
    cpu_cores: 1
    ram_mb: 4096
    billing: "hourly"
    disk_size: 40
  storage:
    install_path: /opt/install/app
    disks:
      - size: 20
        label: vm-infra-os
        mount: /mnt/data1
      - size: 40
        label: vm-infra-data
        mount: /mnt/data2
    volumes:
      - name: config
        path: /mnt/data2/etc/app
      - name: docs
        path: /mnt/data2/var/docs/app
      - name: data
        path: /mnt/data2/var/data/app
      - name: logs
        path: /mnt/data2/var/logs/app
      - name: serve
        path: /mnt/data2/var/serve

Application Workers

apiVersion: strata.huybrechts.xyz/v1
kind: resource
meta:
  name: kamatera_vm_worker
  annotations:
    description: Kamatera Virtual Machine — Docker Swarm worker node
  labels:
    version: "1.0.0"
  tags: [kamatera, vm, worker]
spec:
  properties:
    provider_type: kamatera
    resource_type: virtualmachine
    unit_cost: 6.00 # USD per month
  configuration:
    os_name: "Ubuntu"
    os_code: "24.04 64bit"
    cpu_type: "A"
    cpu_cores: 1
    ram_mb: 2048
    billing: "hourly"
  storage:
    install_path: /opt/install/app
    disks:
      - size: 20
        label: vm-worker-os
        mount: /mnt/data1
    volumes:
      - name: config
        path: /mnt/data1/etc/app
      - name: docs
        path: /mnt/data1/var/docs/app
      - name: data
        path: /mnt/data1/var/data/app
      - name: logs
        path: /mnt/data1/var/logs/app
      - name: serve
        path: /mnt/data1/var/serve

---

Namespace

apiVersion: strata.huybrechts.xyz/v1
kind: namespace
meta:
  name: kamatera_ns_base
  annotations:
    description: Base infrastructure stack for the Kamatera Swarm platform
  labels:
    version: "1.0.0"
  tags: [kamatera, namespace]
spec:
  modules:
    - name: traefik
      file: "@kamatera_swarm/stack/kamatera-mod-traefik.yaml"

---

Module

Traefik Ingress

apiVersion: strata.huybrechts.xyz/v1
kind: module
meta:
  name: kamatera_traefik
  annotations:
    description: Traefik reverse proxy module for routing and load balancing
  labels:
    version: "1.0.0"
  tags: [kamatera, traefik]
spec:
  source:
    repository: kamatera_swarm
    source_path: svc-traefik
  type: compose
  services:
    - name: traefik
      image: traefik:v3.1
      restart: unless-stopped
      ports:
        - "80:80"
        - "443:443"
        - "8080:8080"
      mounts:
        - name: configuration_files
          type: config
          target_path: ${TRAEFIK_PATH_CONFIG}
          chmod: "0644"
          source_path: config
        - name: certificates
          type: config
          chmod: "0600"
          target_path: ${TRAEFIK_PATH_CERTS}
        - name: datafiles
          type: data
          chmod: "0600"
          target_path: ${TRAEFIK_PATH_DATA}
        - name: logging
          type: logs
          chmod: "0644"
          target_path: ${TRAEFIK_PATH_LOGS}
      healthcheck:
        name: traefik_http_check
        type: http
        command: ["traefik", "healthcheck", "--ping"]
        interval: 60s
        timeout: 5s
        retries: 3
    - name: website
      image: nginx:alpine
      restart: unless-stopped
      ports:
        - "8081:80"
      depends_on: [traefik]
  properties:
    endpoints:
      - name: traefik_dashboard
        label: Traefik Dashboard
        url: http://localhost:8080/dashboard/
        description: Access the Traefik web dashboard

---

Environment

apiVersion: strata.huybrechts.xyz/v1
kind: environment
meta:
  name: kamatera_swarm_env_prd
  annotations:
    description: Production environment for Kamatera Docker Swarm
  labels:
    version: "1.0.0"
  tags: [kamatera, swarm, production]
spec:
  variables:
    - key: WORKSPACE
      store: constant
      value: platform
    - key: DATACENTER
      store: constant
      value: kamatera-eu-fr
  secrets:
    # Terraform Cloud/Enterprise API token
    - key: TERRAFORM_API_TOKEN
      store: bitwarden
      value: <bitwarden-item-id>
    # Kamatera API credentials
    - key: KAMATERA_API_KEY
      store: bitwarden
      value: <bitwarden-item-id>
    - key: KAMATERA_API_SECRET
      store: bitwarden
      value: <bitwarden-item-id>
    # SSH keys and root password for VM provisioning
    - key: KAMATERA_PRIVATE_KEY
      store: bitwarden
      value: <bitwarden-item-id>
    - key: KAMATERA_PUBLIC_KEY
      store: bitwarden
      value: <bitwarden-item-id>
    - key: KAMATERA_ROOT_PASSWORD
      store: bitwarden
      value: <bitwarden-item-id>

---

Deployment

apiVersion: strata.huybrechts.xyz/v1
kind: deployment
meta:
  name: kamatera_swarm_deploy_prd
  annotations:
    description: Production deployment for Kamatera Docker Swarm platform
  labels:
    version: "1.0.0"
  tags: [kamatera, swarm, production, deployment]
spec:
  layers:
    environment: prd

  properties:
    environment: prd

  workspace:
    name: kamatera_swarm_platform
    description: Kamatera Docker Swarm Platform Workspace
    file: "@kamatera_swarm/stack/kamatera-ws-platform.yaml"

  environments:
    - "@kamatera_swarm/environments/kamatera-swarm-env-prd.yaml"

  stages:
    - name: infrastructure
      provisioner: terraform
      scope: all
      on_failure: stop