feat: new community asset collector (#146)

Co-authored-by: Jason Rasmussen <jason@rasm.me>
Co-authored-by: Zack Pollard <zackpollard@ymail.com>

deployment/modules/cloudflare/workers/datasets/.terraform.lock.hcl

@@ -0,0 +1,25 @@
+# This file is maintained automatically by "tofu init".
+# Manual edits may be lost in future updates.
+
+provider "registry.opentofu.org/cloudflare/cloudflare" {
+  version     = "4.52.0"
+  constraints = "4.52.0"
+  hashes = [
+    "h1:NTaOQfYINA0YTG/V1/9+SYtgX1it63+cBugj4WK4FWc=",
+    "zh:19be1a91c982b902c42aba47766860dfa5dc151eed1e95fd39ca642229381ef0",
+    "zh:1de451c4d1ecf7efbe67b6dace3426ba810711afdd644b0f1b870364c8ae91f8",
+    "zh:352b4a2120173298622e669258744554339d959ac3a95607b117a48ee4a83238",
+    "zh:3c6f1346d9154afbd2d558fabb4b0150fc8d559aa961254144fe1bc17fe6032f",
+    "zh:4c4c92d53fb535b1e0eff26f222bbd627b97d3b4c891ec9c321268676d06152f",
+    "zh:53276f68006c9ceb7cdb10a6ccf91a5c1eadd1407a28edb5741e84e88d7e29e8",
+    "zh:7925a97773948171a63d4f65bb81ee92fd6d07a447e36012977313293a5435c9",
+    "zh:7dfb0a4496cfe032437386d0a2cd9229a1956e9c30bd920923c141b0f0440060",
+    "zh:890df766e9b839623b1f0437355032a3c006226a6c200cd911e15ee1a9014e9f",
+    "zh:8d4aa79f0a414bb4163d771063c70cd991c8fac6c766e685bac2ee12903c5bd6",
+    "zh:a67540c13565616a7e7e51ee9366e88b0dc60046e1d75c72680e150bd02725bb",
+    "zh:a936383a4767f5393f38f622e92bf2d0c03fe04b69c284951f27345766c7b31b",
+    "zh:d4887d73c466ff036eecf50ad6404ba38fd82ea4855296b1846d244b0f13c380",
+    "zh:e9093c8bd5b6cd99c81666e315197791781b8f93afa14fc2e0f732d1bb2a44b7",
+    "zh:efd3b3f1ec59a37f635aa1d4efcf178734c2fcf8ddb0d56ea690bec342da8672",
+  ]
+}

deployment/modules/cloudflare/workers/datasets/config.tf

@@ -0,0 +1,11 @@
+terraform {
+  backend "pg" {}
+  required_version = "~> 1.7"
+
+  required_providers {
+    cloudflare = {
+      source = "cloudflare/cloudflare"
+      version = "4.52.0"
+    }
+  }
+}

deployment/modules/cloudflare/workers/datasets/locals.tf

@@ -0,0 +1,5 @@
+locals {
+  resource_stage  = var.stage != "" ? "-${var.stage}" : ""
+  resource_env    = "-${var.env}"
+  resource_suffix = "${local.resource_env}${local.resource_stage}"
+}

deployment/modules/cloudflare/workers/datasets/providers.tf

@@ -0,0 +1,3 @@
+provider "cloudflare" {
+  api_token = data.terraform_remote_state.api_keys_state.outputs.terraform_key_cloudflare_account
+}

deployment/modules/cloudflare/workers/datasets/r2.tf

@@ -0,0 +1,5 @@
+resource "cloudflare_r2_bucket" "uploads" {
+  account_id = var.cloudflare_account_id
+  name       = "datasets-uploads${local.resource_suffix}"
+  location   = "WEUR"
+}

deployment/modules/cloudflare/workers/datasets/remote-state.tf

@@ -0,0 +1,17 @@
+data "terraform_remote_state" "api_keys_state" {
+  backend = "pg"
+
+  config = {
+    conn_str = var.tf_state_postgres_conn_str
+    schema_name = "prod_cloudflare_api_keys"
+  }
+}
+
+data "terraform_remote_state" "cloudflare_account" {
+  backend = "pg"
+
+  config = {
+    conn_str = var.tf_state_postgres_conn_str
+    schema_name = "prod_cloudflare_account"
+  }
+}

deployment/modules/cloudflare/workers/datasets/terragrunt.hcl

@@ -0,0 +1,26 @@
+terraform {
+  source = "."
+
+  extra_arguments custom_vars {
+    commands = get_terraform_commands_that_need_vars()
+  }
+}
+
+include {
+  path = find_in_parent_folders("state.hcl")
+}
+
+locals {
+  env = get_env("TF_VAR_env")
+  stage = get_env("TF_VAR_stage")
+  app_name = replace(get_env("TF_VAR_app_name"), "-", "_")
+}
+
+remote_state {
+  backend = "pg"
+
+  config = {
+    conn_str = get_env("TF_VAR_tf_state_postgres_conn_str")
+    schema_name = "cloudflare_workers_immich_app_${local.app_name}_${local.env}${local.stage}"
+  }
+}

deployment/modules/cloudflare/workers/datasets/variables.tf

@@ -0,0 +1,6 @@
+variable "tf_state_postgres_conn_str" {}
+variable "stage" {}
+variable "env" {}
+variable "app_name" {}
+variable "cloudflare_account_id" {}
+variable "dist_dir" {}

deployment/modules/cloudflare/workers/datasets/worker.tf

@@ -0,0 +1,51 @@
+resource "cloudflare_workers_script" "api" {
+  account_id           = var.cloudflare_account_id
+  name                 = "datasets-api${local.resource_suffix}"
+  content              = file("${var.dist_dir}/index.js")
+  compatibility_date   = "2025-06-03"
+  module               = true
+
+  secret_text_binding {
+    name = "CF_TURNSTILE_SECRET"
+    text = data.terraform_remote_state.cloudflare_account.outputs.turnstile_default_invisible_secret
+  }
+
+  secret_text_binding {
+    name = "JWT_SECRET"
+    text = random_password.jwt_secret.result
+  }
+
+  r2_bucket_binding {
+    name        = "IMAGE_UPLOADS"
+    bucket_name = cloudflare_r2_bucket.uploads.name
+  }
+}
+
+data "cloudflare_zone" "immich_app" {
+  name = "immich.app"
+}
+
+resource "cloudflare_workers_route" "dataset_api_root" {
+  pattern     = "${module.domain.fqdn}/api"
+  script_name = cloudflare_workers_script.api.name
+  zone_id     = data.cloudflare_zone.immich_app.zone_id
+}
+
+resource "cloudflare_workers_route" "dataset_api_wildcard" {
+  pattern     = "${module.domain.fqdn}/api/*"
+  script_name = cloudflare_workers_script.api.name
+  zone_id     = data.cloudflare_zone.immich_app.zone_id
+}
+
+resource "random_password" "jwt_secret" {
+  length           = 32
+  special          = true
+}
+
+module "domain" {
+  source = "git::https://github.com/immich-app/devtools.git//tf/shared/modules/domain?ref=main"
+
+  app_name = var.app_name
+  stage    = var.stage
+  env      = var.env
+}