Moved off AWS. (#2)
- Instance in Hetzner. - Data stored in Backblaze B2. Reviewed-on: #2 Co-authored-by: M. V. Hutz <git@maximhutz.me> Co-committed-by: M. V. Hutz <git@maximhutz.me>
This commit is contained in:
200
playbooks/deploy.yml
Normal file
200
playbooks/deploy.yml
Normal file
@@ -0,0 +1,200 @@
|
||||
- name: Set up for fresh host.
|
||||
gather_facts: false
|
||||
hosts: localhost
|
||||
vars_files:
|
||||
- ../vault.yml
|
||||
- ../dist/terraform_outputs.yml
|
||||
tasks:
|
||||
- name: Add remote host.
|
||||
ansible.builtin.add_host:
|
||||
name: server_fresh
|
||||
ansible_ssh_host: "{{ server_ip.value }}"
|
||||
ansible_user: root
|
||||
ansible_port: 22
|
||||
ansible_private_key_file: "{{ secret.private_ssh_key_path }}"
|
||||
|
||||
- name: Switch port to 2222.
|
||||
hosts: server_fresh
|
||||
ignore_unreachable: true
|
||||
gather_facts: false
|
||||
tasks:
|
||||
- name: Update SSH port.
|
||||
ansible.builtin.lineinfile:
|
||||
dest: "/etc/ssh/sshd_config"
|
||||
regexp: "^Port"
|
||||
line: "Port 2222"
|
||||
|
||||
- name: Restart service.
|
||||
ansible.builtin.service:
|
||||
name: ssh
|
||||
state: restarted
|
||||
|
||||
- name: Set up real host.
|
||||
gather_facts: false
|
||||
hosts: localhost
|
||||
tags:
|
||||
- deploy
|
||||
vars_files:
|
||||
- ../vault.yml
|
||||
- ../dist/terraform_outputs.yml
|
||||
tasks:
|
||||
- name: Add remote host.
|
||||
ansible.builtin.add_host:
|
||||
name: server
|
||||
ansible_ssh_host: "{{ server_ip.value }}"
|
||||
ansible_user: root
|
||||
ansible_port: 2222
|
||||
ansible_private_key_file: "{{ secret.private_ssh_key_path }}"
|
||||
|
||||
- name: Install Docker.
|
||||
gather_facts: true
|
||||
hosts: server
|
||||
vars_files:
|
||||
- ../vault.yml
|
||||
- ../dist/terraform_outputs.yml
|
||||
tasks:
|
||||
- name: Install PIP.
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- python3-pip
|
||||
state: present
|
||||
|
||||
- name: Install needed packages.
|
||||
ansible.builtin.pip:
|
||||
name:
|
||||
- botocore
|
||||
- boto3
|
||||
- packaging
|
||||
state: present
|
||||
break_system_packages: true
|
||||
|
||||
- name: Download Docker repository key.
|
||||
ansible.builtin.apt_key:
|
||||
url: https://download.docker.com/linux/debian/gpg
|
||||
state: present
|
||||
|
||||
- name: Download Docker repository.
|
||||
ansible.builtin.apt_repository:
|
||||
repo: "deb https://download.docker.com/linux/debian {{ ansible_distribution_release }} stable"
|
||||
state: present
|
||||
|
||||
- name: Remove bad packages.
|
||||
ansible.builtin.apt:
|
||||
state: absent
|
||||
package:
|
||||
- docker.io
|
||||
- docker-doc
|
||||
- docker-compose
|
||||
- podman-docker
|
||||
- containerd
|
||||
- runc
|
||||
|
||||
- name: Download Docker dependencies.
|
||||
ansible.builtin.apt:
|
||||
state: present
|
||||
package:
|
||||
- ca-certificates
|
||||
- curl
|
||||
|
||||
- name: Download Docker packages.
|
||||
ansible.builtin.apt:
|
||||
state: present
|
||||
update_cache: true
|
||||
package:
|
||||
- docker-ce
|
||||
- docker-ce-cli
|
||||
- containerd.io
|
||||
- docker-buildx-plugin
|
||||
- docker-compose-plugin
|
||||
|
||||
- name: Deploy artifact to instance.
|
||||
hosts: server
|
||||
tags:
|
||||
- deploy
|
||||
gather_facts: false
|
||||
vars_files:
|
||||
- ../variables.yml
|
||||
- ../vault.yml
|
||||
- ../dist/terraform_outputs.yml
|
||||
tasks:
|
||||
- name: Copy gitea folder.
|
||||
ansible.builtin.copy:
|
||||
src: ../gitea/
|
||||
dest: /root/gitea/
|
||||
mode: preserve
|
||||
|
||||
- name: Build image.
|
||||
community.docker.docker_image_build:
|
||||
name: "{{ variables.image_name }}"
|
||||
path: /root/gitea
|
||||
nocache: true
|
||||
rebuild: always
|
||||
pull: true
|
||||
|
||||
- name: Create data directory.
|
||||
ansible.builtin.file:
|
||||
path: /root/data
|
||||
state: directory
|
||||
mode: '0777'
|
||||
|
||||
- name: Run image.
|
||||
community.docker.docker_container:
|
||||
name: server
|
||||
image: "{{ variables.image_name }}"
|
||||
state: started
|
||||
recreate: true
|
||||
restart_policy: unless-stopped
|
||||
memory: 425m
|
||||
memory_swap: 900m
|
||||
ports: [80:80, 443:443, "22:22"]
|
||||
env:
|
||||
# Secrets.
|
||||
GITEA__security__INTERNAL_TOKEN: "{{ secret.internal }}"
|
||||
GITEA__server__LFS_JWT_SECRET: "{{ secret.lfs }}"
|
||||
GITEA__oauth2__JWT_SECRET: "{{ secret.jwt }}"
|
||||
GITEA__server__ACME_EMAIL: "acme@maximhutz.me"
|
||||
GITEA__server__SSH_DOMAIN: "{{ server_fqdn.value }}"
|
||||
GITEA__server__DOMAIN: "{{ server_fqdn.value }}"
|
||||
GITEA__server__ROOT_URL: "https://{{ server_fqdn.value }}/"
|
||||
|
||||
# General S3 storage information.
|
||||
GITEA__storage__MINIO_BUCKET: "{{ secret.bucket.name }}"
|
||||
GITEA__storage__MINIO_ENDPOINT: "{{ secret.bucket.endpoint }}"
|
||||
GITEA__storage__MINIO_ACCESS_KEY_ID: "{{ secret.bucket.access_key }}"
|
||||
GITEA__storage__MINIO_SECRET_ACCESS_KEY: "{{ secret.bucket.secret_key }}"
|
||||
|
||||
# Set storage to specific S3 bucket path.
|
||||
GITEA__storage_0x2E_attachments__MINIO_BASE_PATH: "{{ secret.storage.key }}/attachments"
|
||||
GITEA__storage_0x2E_lfs__MINIO_BASE_PATH: "{{ secret.storage.key }}/lfs"
|
||||
GITEA__storage_0x2E_avatars__MINIO_BASE_PATH: "{{ secret.storage.key }}/avatars"
|
||||
GITEA__storage_0x2E_repo_0X2D_archive___MINIO_BASE_PATH: "{{ secret.storage.key }}/repo-archive"
|
||||
GITEA__storage_0x2E_repo_0X2D_avatars__MINIO_BASE_PATH: "{{ secret.storage.key }}/repo-avatars"
|
||||
GITEA__storage_0x2E_packages__MINIO_BASE_PATH: "{{ secret.storage.key }}/packages"
|
||||
GITEA__storage_0x2E_actions_log__MINIO_BASE_PATH: "{{ secret.storage.key }}/actions_log"
|
||||
GITEA__storage_0x2E_actions_artifacts__MINIO_BASE_PATH: "{{ secret.storage.key }}/actions_artifacts"
|
||||
|
||||
labels:
|
||||
docker-volume-backup.stop-during-backup: "true"
|
||||
volumes:
|
||||
- /root/data:/var/lib/gitea
|
||||
- /etc/timezone:/etc/timezone:ro
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
|
||||
- name: Run backup.
|
||||
community.docker.docker_container:
|
||||
name: backup
|
||||
image: offen/docker-volume-backup:v2
|
||||
state: started
|
||||
recreate: true
|
||||
restart_policy: unless-stopped
|
||||
volumes:
|
||||
- /root/data:/backup/my-app-backup:ro
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
env:
|
||||
AWS_S3_BUCKET_NAME: "{{ secret.bucket.name }}"
|
||||
AWS_S3_PATH: "{{ secret.backup.key }}"
|
||||
AWS_REGION: "{{ secret.bucket.region }}"
|
||||
AWS_ACCESS_KEY_ID: "{{ secret.bucket.access_key }}"
|
||||
AWS_SECRET_ACCESS_KEY: "{{ secret.bucket.secret_key }}"
|
||||
AWS_ENDPOINT: "{{ secret.bucket.endpoint }}"
|
||||
BACKUP_CRON_EXPRESSION: "0 0 * * *"
|
||||
@@ -1,91 +0,0 @@
|
||||
- name: Make build artifact.
|
||||
hosts: localhost
|
||||
vars_files:
|
||||
- ../config/ansible.secret.json
|
||||
- ../config/infrastructure.secret.json
|
||||
gather_facts: false
|
||||
tasks:
|
||||
- name: Log into Docker.
|
||||
community.docker.docker_login:
|
||||
registry_url: '{{ full_domain.value }}'
|
||||
username: '{{ username }}'
|
||||
password: '{{ api_key }}'
|
||||
reauthorize: true
|
||||
|
||||
- name: Build image.
|
||||
community.docker.docker_image_build:
|
||||
name: "{{ full_domain.value }}/{{ image_name }}:latest"
|
||||
path: ../gitea
|
||||
nocache: true
|
||||
rebuild: always
|
||||
pull: true
|
||||
outputs: [{ type: image, push: true }]
|
||||
platform:
|
||||
- linux/amd64
|
||||
- linux/arm64/v8
|
||||
|
||||
- name: Log out of Docker.
|
||||
community.docker.docker_login:
|
||||
state: absent
|
||||
|
||||
- name: Deploy artifact to instance.
|
||||
hosts: localhost
|
||||
become: true
|
||||
gather_facts: false
|
||||
vars_files:
|
||||
- ../config/ansible.secret.json
|
||||
- ../config/infrastructure.secret.json
|
||||
vars:
|
||||
ansible_connection: aws_ssm
|
||||
ansible_aws_ssm_plugin: "{{ ssm_plugin }}"
|
||||
ansible_aws_ssm_bucket_name: "{{ image_bucket }}"
|
||||
ansible_aws_ssm_instance_id: "{{ instance_id.value }}"
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
ansible_aws_ssm_region: "{{ aws_region }}"
|
||||
ansible_aws_ssm_access_key_id: "{{ aws_access_key }}"
|
||||
ansible_aws_ssm_secret_access_key: "{{ aws_secret_key }}"
|
||||
tasks:
|
||||
- name: Run image.
|
||||
community.docker.docker_container:
|
||||
name: server
|
||||
image: "{{ full_domain.value }}/{{ image_name }}:latest"
|
||||
state: started
|
||||
recreate: true
|
||||
restart_policy: unless-stopped
|
||||
memory: 425m
|
||||
memory_swap: 900m
|
||||
ports: [80:80, 2222:2222, 443:443, "22:22"]
|
||||
env:
|
||||
GITEA__security__INTERNAL_TOKEN: "{{ internal_secret }}"
|
||||
GITEA__server__LFS_JWT_SECRET: "{{ lfs_secret }}"
|
||||
GITEA__oauth2__JWT_SECRET: "{{ jwt_secret }}"
|
||||
GITEA__server__ACME_EMAIL: "{{ email }}"
|
||||
GITEA__server__SSH_DOMAIN: "{{ full_domain.value }}"
|
||||
GITEA__server__DOMAIN: "{{ full_domain.value }}"
|
||||
GITEA__server__ROOT_URL: "https://{{ full_domain.value }}/"
|
||||
GITEA__storage__MINIO_ACCESS_KEY_ID: "{{ minio_access_key }}"
|
||||
GITEA__storage__MINIO_SECRET_ACCESS_KEY: "{{ minio_secret_key }}"
|
||||
labels:
|
||||
docker-volume-backup.stop-during-backup: "true"
|
||||
volumes:
|
||||
- /home/ssm-user/data:/var/lib/gitea
|
||||
- /etc/timezone:/etc/timezone:ro
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
|
||||
- name: Run backup.
|
||||
community.docker.docker_container:
|
||||
name: backup
|
||||
image: offen/docker-volume-backup:v2
|
||||
state: started
|
||||
recreate: true
|
||||
restart_policy: unless-stopped
|
||||
volumes:
|
||||
- /home/ssm-user/data:/backup/my-app-backup:ro
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
env:
|
||||
AWS_S3_BUCKET_NAME: "{{ boot_bucket }}"
|
||||
AWS_S3_PATH: "{{ boot_key }}"
|
||||
AWS_REGION: "{{ boot_region.value }}"
|
||||
AWS_ACCESS_KEY_ID: "{{ boot_id.value }}"
|
||||
AWS_SECRET_ACCESS_KEY: "{{ boot_secret.value }}"
|
||||
BACKUP_CRON_EXPRESSION: "0 0 * * *"
|
||||
38
playbooks/provision.yml
Normal file
38
playbooks/provision.yml
Normal file
@@ -0,0 +1,38 @@
|
||||
- name: Deploy terraform infrastructure.
|
||||
hosts: localhost
|
||||
gather_facts: false
|
||||
vars_files:
|
||||
- ../vault.yml
|
||||
tasks:
|
||||
- name: Reconfigure and plan.
|
||||
community.general.terraform:
|
||||
project_path: '../terraform'
|
||||
state: "planned"
|
||||
plan_file: plan.out
|
||||
# init_reconfigure: true
|
||||
backend_config: "{{ terraform.backend }}"
|
||||
variables: "{{ terraform.variables }}"
|
||||
complex_vars: true
|
||||
|
||||
- name: Apply.
|
||||
community.general.terraform:
|
||||
project_path: '../terraform'
|
||||
state: "present"
|
||||
plan_file: plan.out
|
||||
backend_config: "{{ terraform.backend }}"
|
||||
variables: "{{ terraform.variables }}"
|
||||
complex_vars: true
|
||||
register: terraform_apply
|
||||
|
||||
- name: Create secret directory.
|
||||
ansible.builtin.file:
|
||||
path: ../dist
|
||||
recurse: true
|
||||
mode: "0755"
|
||||
state: directory
|
||||
|
||||
- name: Send outputs to file.
|
||||
ansible.builtin.copy:
|
||||
content: "{{ terraform_apply.outputs }}"
|
||||
dest: ../dist/terraform_outputs.yml
|
||||
mode: '0755'
|
||||
@@ -1,19 +1,25 @@
|
||||
- name: Deploy artifact to instance.
|
||||
- name: Set up real host.
|
||||
gather_facts: false
|
||||
hosts: localhost
|
||||
vars_files:
|
||||
- ../vault.yml
|
||||
- ../dist/terraform_outputs.yml
|
||||
tasks:
|
||||
- name: Add remote host.
|
||||
ansible.builtin.add_host:
|
||||
name: server
|
||||
ansible_ssh_host: "{{ server_ip.value }}"
|
||||
ansible_user: root
|
||||
ansible_port: 2222
|
||||
ansible_private_key_file: "{{ secret.private_ssh_key_path }}"
|
||||
|
||||
- name: Deploy artifact to instance.
|
||||
hosts: server
|
||||
become: true
|
||||
gather_facts: false
|
||||
vars_files:
|
||||
- ../config/ansible.secret.json
|
||||
- ../config/infrastructure.secret.json
|
||||
vars:
|
||||
ansible_connection: aws_ssm
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
ansible_aws_ssm_plugin: "{{ ssm_plugin }}"
|
||||
ansible_aws_ssm_bucket_name: "{{ image_bucket }}"
|
||||
ansible_aws_ssm_instance_id: "{{ instance_id.value }}"
|
||||
ansible_aws_ssm_region: "{{ aws_region }}"
|
||||
ansible_aws_ssm_access_key_id: "{{ aws_access_key }}"
|
||||
ansible_aws_ssm_secret_access_key: "{{ aws_secret_key }}"
|
||||
- ../vault.yml
|
||||
- ../dist/terraform_outputs.yml
|
||||
tasks:
|
||||
- name: Stop server.
|
||||
community.docker.docker_container:
|
||||
@@ -22,38 +28,38 @@
|
||||
loop: [server, backup]
|
||||
|
||||
- name: Copy backup from S3.
|
||||
environment:
|
||||
region: "{{ boot_region.value }}"
|
||||
access_key: "{{ boot_id.value }}"
|
||||
secret_key: "{{ boot_secret.value }}"
|
||||
amazon.aws.s3_object:
|
||||
bucket: "{{ restore_bucket | mandatory(msg='You must specify the bucket of the data.') }}"
|
||||
object: "{{ restore_key | mandatory(msg='You must specify the key of the data.') }}"
|
||||
dest: /home/ssm-user/backup.tar.gz
|
||||
bucket: "{{ secret.restore.bucket | mandatory(msg='You must specify the bucket of the data.') }}"
|
||||
object: "{{ secret.restore.key | mandatory(msg='You must specify the key of the data.') }}"
|
||||
dest: /root/snapshot.tar.gz
|
||||
mode: get
|
||||
region: "{{ secret.restore.region }}"
|
||||
access_key: "{{ secret.restore.access_key }}"
|
||||
secret_key: "{{ secret.restore.secret_key }}"
|
||||
ignore_nonexistent_bucket: true
|
||||
|
||||
- name: Ensure backup directory exists.
|
||||
ansible.builtin.file:
|
||||
path: /home/ssm-user/backup
|
||||
path: /root/restore
|
||||
state: directory
|
||||
mode: '0777'
|
||||
|
||||
- name: Extract backup.
|
||||
ansible.builtin.unarchive:
|
||||
src: /home/ssm-user/backup.tar.gz
|
||||
dest: /home/ssm-user/backup
|
||||
src: /root/snapshot.tar.gz
|
||||
dest: /root/restore
|
||||
remote_src: true
|
||||
|
||||
- name: Move backup files to data folder.
|
||||
ansible.builtin.copy:
|
||||
remote_src: true
|
||||
src: /home/ssm-user/backup/backup/my-app-backup/
|
||||
dest: /home/ssm-user/data/
|
||||
src: /root/restore/backup/my-app-backup/
|
||||
dest: /root/data/
|
||||
mode: '0777'
|
||||
|
||||
- name: Update permissions.
|
||||
ansible.builtin.file:
|
||||
path: /home/ssm-user/data
|
||||
path: /root/data
|
||||
recurse: true
|
||||
mode: '0777'
|
||||
owner: 1000
|
||||
|
||||
@@ -1,121 +0,0 @@
|
||||
- name: Make build artifact.
|
||||
hosts: localhost
|
||||
vars_files: ../config/ansible.secret.json
|
||||
gather_facts: false
|
||||
tasks:
|
||||
- name: Build image.
|
||||
community.docker.docker_image_build:
|
||||
name: "{{ image_name }}"
|
||||
path: ../gitea
|
||||
nocache: true
|
||||
rebuild: always
|
||||
pull: true
|
||||
|
||||
- name: Push image to archive.
|
||||
community.docker.docker_image:
|
||||
name: "{{ image_name }}"
|
||||
archive_path: ../dist/image.tar
|
||||
source: local
|
||||
|
||||
- name: Compress archive to artifact.
|
||||
register: compress_image
|
||||
community.general.archive:
|
||||
path: ../dist/image.tar
|
||||
dest: ../dist/image.tar.xz
|
||||
format: xz
|
||||
mode: "0644"
|
||||
|
||||
- name: Push artifact to S3.
|
||||
amazon.aws.s3_object:
|
||||
bucket: "{{ image_bucket }}"
|
||||
object: "{{ image_key }}"
|
||||
src: ../dist/image.tar.xz
|
||||
mode: put
|
||||
|
||||
region: "{{ aws_region }}"
|
||||
access_key: "{{ aws_access_key }}"
|
||||
secret_key: "{{ aws_secret_key }}"
|
||||
|
||||
- name: Deploy artifact to instance.
|
||||
hosts: localhost
|
||||
become: true
|
||||
gather_facts: false
|
||||
vars_files:
|
||||
- ../config/ansible.secret.json
|
||||
- ../config/infrastructure.secret.json
|
||||
vars:
|
||||
ansible_connection: aws_ssm
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
ansible_aws_ssm_plugin: "{{ ssm_plugin }}"
|
||||
ansible_aws_ssm_bucket_name: "{{ image_bucket }}"
|
||||
ansible_aws_ssm_instance_id: "{{ instance_id.value }}"
|
||||
ansible_aws_ssm_region: "{{ aws_region }}"
|
||||
ansible_aws_ssm_access_key_id: "{{ aws_access_key }}"
|
||||
ansible_aws_ssm_secret_access_key: "{{ aws_secret_key }}"
|
||||
tasks:
|
||||
- name: Fetch image.
|
||||
amazon.aws.s3_object:
|
||||
mode: get
|
||||
bucket: "{{ image_bucket }}"
|
||||
object: "{{ image_key }}"
|
||||
dest: /root/image.tar.gz
|
||||
|
||||
region: "{{ aws_region }}"
|
||||
access_key: "{{ aws_access_key }}"
|
||||
secret_key: "{{ aws_secret_key }}"
|
||||
|
||||
- name: Create data directory.
|
||||
ansible.builtin.file:
|
||||
path: /home/ssm-user/data
|
||||
state: directory
|
||||
mode: '0777'
|
||||
|
||||
- name: Load image.
|
||||
community.docker.docker_image_load:
|
||||
path: /root/image.tar.gz
|
||||
register: image
|
||||
|
||||
- name: Run image.
|
||||
community.docker.docker_container:
|
||||
name: server
|
||||
image: "{{ image.image_names[0] }}"
|
||||
state: started
|
||||
recreate: true
|
||||
restart_policy: unless-stopped
|
||||
memory: 425m
|
||||
memory_swap: 900m
|
||||
ports: [80:80, 2222:2222, 443:443, "22:22"]
|
||||
env:
|
||||
GITEA__security__INTERNAL_TOKEN: "{{ internal_secret }}"
|
||||
GITEA__server__LFS_JWT_SECRET: "{{ lfs_secret }}"
|
||||
GITEA__oauth2__JWT_SECRET: "{{ jwt_secret }}"
|
||||
GITEA__server__ACME_EMAIL: "{{ email }}"
|
||||
GITEA__server__SSH_DOMAIN: "{{ full_domain.value }}"
|
||||
GITEA__server__DOMAIN: "{{ full_domain.value }}"
|
||||
GITEA__server__ROOT_URL: "https://{{ full_domain.value }}/"
|
||||
GITEA__storage__MINIO_ACCESS_KEY_ID: "{{ minio_access_key }}"
|
||||
GITEA__storage__MINIO_SECRET_ACCESS_KEY: "{{ minio_secret_key }}"
|
||||
labels:
|
||||
docker-volume-backup.stop-during-backup: "true"
|
||||
volumes:
|
||||
- /home/ssm-user/data:/var/lib/gitea
|
||||
- /etc/timezone:/etc/timezone:ro
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
|
||||
- name: Run backup.
|
||||
community.docker.docker_container:
|
||||
name: backup
|
||||
image: offen/docker-volume-backup:v2
|
||||
state: started
|
||||
recreate: true
|
||||
restart_policy: unless-stopped
|
||||
volumes:
|
||||
- /home/ssm-user/data:/backup/my-app-backup:ro
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
env:
|
||||
AWS_S3_BUCKET_NAME: "{{ boot_bucket }}"
|
||||
AWS_S3_PATH: "{{ boot_key }}"
|
||||
AWS_REGION: "{{ boot_region.value }}"
|
||||
AWS_ACCESS_KEY_ID: "{{ boot_id.value }}"
|
||||
AWS_SECRET_ACCESS_KEY: "{{ boot_secret.value }}"
|
||||
BACKUP_CRON_EXPRESSION: "0 0 * * *"
|
||||
Reference in New Issue
Block a user