feat: hetz cloud server provisioned
This commit is contained in:
3
.gitignore
vendored
3
.gitignore
vendored
@@ -213,4 +213,5 @@ cython_debug/
|
|||||||
*secret*
|
*secret*
|
||||||
.vscode
|
.vscode
|
||||||
.DS_Store
|
.DS_Store
|
||||||
*.key
|
*.key
|
||||||
|
*.out
|
||||||
23
Taskfile.yml
23
Taskfile.yml
@@ -1,24 +1,5 @@
|
|||||||
version: 3
|
version: 3
|
||||||
|
|
||||||
# includes:
|
|
||||||
# tf: { taskfile: terraform, dir: terraform }
|
|
||||||
|
|
||||||
# tasks:
|
|
||||||
# dev:
|
|
||||||
# - docker compose -f compose.dev.yml rm -fsv
|
|
||||||
# - docker compose -f compose.dev.yml up --build --force-recreate --no-deps
|
|
||||||
|
|
||||||
# deploy:fast: ansible-playbook playbooks/fast.yml
|
|
||||||
# deploy:slow: ansible-playbook playbooks/slow.yml
|
|
||||||
# deploy:restore: ansible-playbook playbooks/restore.yml -e "restore_bucket={{.BUCKET}} restore_key={{.KEY}}"
|
|
||||||
|
|
||||||
# enter:
|
|
||||||
# cmd: aws ssm start-session --target $INSTANCE_ID
|
|
||||||
# env:
|
|
||||||
# INSTANCE_ID: { sh: jq -r .instance_id.value < config/infrastructure.secret.json }
|
|
||||||
# AWS_REGION: { sh: jq -r .aws_region < config/ansible.secret.json }
|
|
||||||
# AWS_ACCESS_KEY_ID: { sh: jq -r .aws_access_key < config/ansible.secret.json }
|
|
||||||
# AWS_SECRET_ACCESS_KEY: { sh: jq -r .aws_secret_key < config/ansible.secret.json }
|
|
||||||
|
|
||||||
tasks:
|
tasks:
|
||||||
vault:edit: ansible-vault edit vault.yml
|
vault: ansible-vault edit vault.yml
|
||||||
|
infra: ansible-playbook playbooks/infrastructure.yml
|
||||||
@@ -1,91 +0,0 @@
|
|||||||
- name: Make build artifact.
|
|
||||||
hosts: localhost
|
|
||||||
vars_files:
|
|
||||||
- ../config/ansible.secret.json
|
|
||||||
- ../config/infrastructure.secret.json
|
|
||||||
gather_facts: false
|
|
||||||
tasks:
|
|
||||||
- name: Log into Docker.
|
|
||||||
community.docker.docker_login:
|
|
||||||
registry_url: '{{ full_domain.value }}'
|
|
||||||
username: '{{ username }}'
|
|
||||||
password: '{{ api_key }}'
|
|
||||||
reauthorize: true
|
|
||||||
|
|
||||||
- name: Build image.
|
|
||||||
community.docker.docker_image_build:
|
|
||||||
name: "{{ full_domain.value }}/{{ image_name }}:latest"
|
|
||||||
path: ../gitea
|
|
||||||
nocache: true
|
|
||||||
rebuild: always
|
|
||||||
pull: true
|
|
||||||
outputs: [{ type: image, push: true }]
|
|
||||||
platform:
|
|
||||||
- linux/amd64
|
|
||||||
- linux/arm64/v8
|
|
||||||
|
|
||||||
- name: Log out of Docker.
|
|
||||||
community.docker.docker_login:
|
|
||||||
state: absent
|
|
||||||
|
|
||||||
- name: Deploy artifact to instance.
|
|
||||||
hosts: localhost
|
|
||||||
become: true
|
|
||||||
gather_facts: false
|
|
||||||
vars_files:
|
|
||||||
- ../config/ansible.secret.json
|
|
||||||
- ../config/infrastructure.secret.json
|
|
||||||
vars:
|
|
||||||
ansible_connection: aws_ssm
|
|
||||||
ansible_aws_ssm_plugin: "{{ ssm_plugin }}"
|
|
||||||
ansible_aws_ssm_bucket_name: "{{ image_bucket }}"
|
|
||||||
ansible_aws_ssm_instance_id: "{{ instance_id.value }}"
|
|
||||||
ansible_python_interpreter: /usr/bin/python3
|
|
||||||
ansible_aws_ssm_region: "{{ aws_region }}"
|
|
||||||
ansible_aws_ssm_access_key_id: "{{ aws_access_key }}"
|
|
||||||
ansible_aws_ssm_secret_access_key: "{{ aws_secret_key }}"
|
|
||||||
tasks:
|
|
||||||
- name: Run image.
|
|
||||||
community.docker.docker_container:
|
|
||||||
name: server
|
|
||||||
image: "{{ full_domain.value }}/{{ image_name }}:latest"
|
|
||||||
state: started
|
|
||||||
recreate: true
|
|
||||||
restart_policy: unless-stopped
|
|
||||||
memory: 425m
|
|
||||||
memory_swap: 900m
|
|
||||||
ports: [80:80, 2222:2222, 443:443, "22:22"]
|
|
||||||
env:
|
|
||||||
GITEA__security__INTERNAL_TOKEN: "{{ internal_secret }}"
|
|
||||||
GITEA__server__LFS_JWT_SECRET: "{{ lfs_secret }}"
|
|
||||||
GITEA__oauth2__JWT_SECRET: "{{ jwt_secret }}"
|
|
||||||
GITEA__server__ACME_EMAIL: "{{ email }}"
|
|
||||||
GITEA__server__SSH_DOMAIN: "{{ full_domain.value }}"
|
|
||||||
GITEA__server__DOMAIN: "{{ full_domain.value }}"
|
|
||||||
GITEA__server__ROOT_URL: "https://{{ full_domain.value }}/"
|
|
||||||
GITEA__storage__MINIO_ACCESS_KEY_ID: "{{ minio_access_key }}"
|
|
||||||
GITEA__storage__MINIO_SECRET_ACCESS_KEY: "{{ minio_secret_key }}"
|
|
||||||
labels:
|
|
||||||
docker-volume-backup.stop-during-backup: "true"
|
|
||||||
volumes:
|
|
||||||
- /home/ssm-user/data:/var/lib/gitea
|
|
||||||
- /etc/timezone:/etc/timezone:ro
|
|
||||||
- /etc/localtime:/etc/localtime:ro
|
|
||||||
|
|
||||||
- name: Run backup.
|
|
||||||
community.docker.docker_container:
|
|
||||||
name: backup
|
|
||||||
image: offen/docker-volume-backup:v2
|
|
||||||
state: started
|
|
||||||
recreate: true
|
|
||||||
restart_policy: unless-stopped
|
|
||||||
volumes:
|
|
||||||
- /home/ssm-user/data:/backup/my-app-backup:ro
|
|
||||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
||||||
env:
|
|
||||||
AWS_S3_BUCKET_NAME: "{{ boot_bucket }}"
|
|
||||||
AWS_S3_PATH: "{{ boot_key }}"
|
|
||||||
AWS_REGION: "{{ boot_region.value }}"
|
|
||||||
AWS_ACCESS_KEY_ID: "{{ boot_id.value }}"
|
|
||||||
AWS_SECRET_ACCESS_KEY: "{{ boot_secret.value }}"
|
|
||||||
BACKUP_CRON_EXPRESSION: "0 0 * * *"
|
|
||||||
38
playbooks/infrastructure.yml
Normal file
38
playbooks/infrastructure.yml
Normal file
@@ -0,0 +1,38 @@
|
|||||||
|
- name: Deploy terraform infrastructure.
|
||||||
|
hosts: localhost
|
||||||
|
gather_facts: false
|
||||||
|
vars_files:
|
||||||
|
- ../vault.yml
|
||||||
|
tasks:
|
||||||
|
- name: Reconfigure and plan.
|
||||||
|
community.general.terraform:
|
||||||
|
project_path: '../terraform'
|
||||||
|
state: "planned"
|
||||||
|
plan_file: plan.out
|
||||||
|
# init_reconfigure: true
|
||||||
|
backend_config: "{{ terraform.backend }}"
|
||||||
|
variables: "{{ terraform.variables }}"
|
||||||
|
complex_vars: true
|
||||||
|
|
||||||
|
- name: Apply.
|
||||||
|
community.general.terraform:
|
||||||
|
project_path: '../terraform'
|
||||||
|
state: "present"
|
||||||
|
plan_file: plan.out
|
||||||
|
backend_config: "{{ terraform.backend }}"
|
||||||
|
variables: "{{ terraform.variables }}"
|
||||||
|
complex_vars: true
|
||||||
|
register: terraform_apply
|
||||||
|
|
||||||
|
- name: Create secret directory.
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: ../secret
|
||||||
|
recurse: true
|
||||||
|
mode: "0755"
|
||||||
|
state: directory
|
||||||
|
|
||||||
|
- name: Send outputs to file.
|
||||||
|
ansible.builtin.copy:
|
||||||
|
content: "{{ terraform_apply.outputs }}"
|
||||||
|
dest: ../secret/terraform_outputs.yml
|
||||||
|
mode: '0755'
|
||||||
@@ -1,66 +0,0 @@
|
|||||||
- name: Deploy artifact to instance.
|
|
||||||
hosts: localhost
|
|
||||||
become: true
|
|
||||||
gather_facts: false
|
|
||||||
vars_files:
|
|
||||||
- ../config/ansible.secret.json
|
|
||||||
- ../config/infrastructure.secret.json
|
|
||||||
vars:
|
|
||||||
ansible_connection: aws_ssm
|
|
||||||
ansible_python_interpreter: /usr/bin/python3
|
|
||||||
ansible_aws_ssm_plugin: "{{ ssm_plugin }}"
|
|
||||||
ansible_aws_ssm_bucket_name: "{{ image_bucket }}"
|
|
||||||
ansible_aws_ssm_instance_id: "{{ instance_id.value }}"
|
|
||||||
ansible_aws_ssm_region: "{{ aws_region }}"
|
|
||||||
ansible_aws_ssm_access_key_id: "{{ aws_access_key }}"
|
|
||||||
ansible_aws_ssm_secret_access_key: "{{ aws_secret_key }}"
|
|
||||||
tasks:
|
|
||||||
- name: Stop server.
|
|
||||||
community.docker.docker_container:
|
|
||||||
name: "{{ item }}"
|
|
||||||
state: stopped
|
|
||||||
loop: [server, backup]
|
|
||||||
|
|
||||||
- name: Copy backup from S3.
|
|
||||||
environment:
|
|
||||||
region: "{{ boot_region.value }}"
|
|
||||||
access_key: "{{ boot_id.value }}"
|
|
||||||
secret_key: "{{ boot_secret.value }}"
|
|
||||||
amazon.aws.s3_object:
|
|
||||||
bucket: "{{ restore_bucket | mandatory(msg='You must specify the bucket of the data.') }}"
|
|
||||||
object: "{{ restore_key | mandatory(msg='You must specify the key of the data.') }}"
|
|
||||||
dest: /home/ssm-user/backup.tar.gz
|
|
||||||
mode: get
|
|
||||||
|
|
||||||
- name: Ensure backup directory exists.
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: /home/ssm-user/backup
|
|
||||||
state: directory
|
|
||||||
mode: '0777'
|
|
||||||
|
|
||||||
- name: Extract backup.
|
|
||||||
ansible.builtin.unarchive:
|
|
||||||
src: /home/ssm-user/backup.tar.gz
|
|
||||||
dest: /home/ssm-user/backup
|
|
||||||
remote_src: true
|
|
||||||
|
|
||||||
- name: Move backup files to data folder.
|
|
||||||
ansible.builtin.copy:
|
|
||||||
remote_src: true
|
|
||||||
src: /home/ssm-user/backup/backup/my-app-backup/
|
|
||||||
dest: /home/ssm-user/data/
|
|
||||||
mode: '0777'
|
|
||||||
|
|
||||||
- name: Update permissions.
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: /home/ssm-user/data
|
|
||||||
recurse: true
|
|
||||||
mode: '0777'
|
|
||||||
owner: 1000
|
|
||||||
group: 1000
|
|
||||||
|
|
||||||
- name: Restart containers.
|
|
||||||
community.docker.docker_container:
|
|
||||||
name: "{{ item }}"
|
|
||||||
state: started
|
|
||||||
loop: [server, backup]
|
|
||||||
@@ -1,121 +0,0 @@
|
|||||||
- name: Make build artifact.
|
|
||||||
hosts: localhost
|
|
||||||
vars_files: ../config/ansible.secret.json
|
|
||||||
gather_facts: false
|
|
||||||
tasks:
|
|
||||||
- name: Build image.
|
|
||||||
community.docker.docker_image_build:
|
|
||||||
name: "{{ image_name }}"
|
|
||||||
path: ../gitea
|
|
||||||
nocache: true
|
|
||||||
rebuild: always
|
|
||||||
pull: true
|
|
||||||
|
|
||||||
- name: Push image to archive.
|
|
||||||
community.docker.docker_image:
|
|
||||||
name: "{{ image_name }}"
|
|
||||||
archive_path: ../dist/image.tar
|
|
||||||
source: local
|
|
||||||
|
|
||||||
- name: Compress archive to artifact.
|
|
||||||
register: compress_image
|
|
||||||
community.general.archive:
|
|
||||||
path: ../dist/image.tar
|
|
||||||
dest: ../dist/image.tar.xz
|
|
||||||
format: xz
|
|
||||||
mode: "0644"
|
|
||||||
|
|
||||||
- name: Push artifact to S3.
|
|
||||||
amazon.aws.s3_object:
|
|
||||||
bucket: "{{ image_bucket }}"
|
|
||||||
object: "{{ image_key }}"
|
|
||||||
src: ../dist/image.tar.xz
|
|
||||||
mode: put
|
|
||||||
|
|
||||||
region: "{{ aws_region }}"
|
|
||||||
access_key: "{{ aws_access_key }}"
|
|
||||||
secret_key: "{{ aws_secret_key }}"
|
|
||||||
|
|
||||||
- name: Deploy artifact to instance.
|
|
||||||
hosts: localhost
|
|
||||||
become: true
|
|
||||||
gather_facts: false
|
|
||||||
vars_files:
|
|
||||||
- ../config/ansible.secret.json
|
|
||||||
- ../config/infrastructure.secret.json
|
|
||||||
vars:
|
|
||||||
ansible_connection: aws_ssm
|
|
||||||
ansible_python_interpreter: /usr/bin/python3
|
|
||||||
ansible_aws_ssm_plugin: "{{ ssm_plugin }}"
|
|
||||||
ansible_aws_ssm_bucket_name: "{{ image_bucket }}"
|
|
||||||
ansible_aws_ssm_instance_id: "{{ instance_id.value }}"
|
|
||||||
ansible_aws_ssm_region: "{{ aws_region }}"
|
|
||||||
ansible_aws_ssm_access_key_id: "{{ aws_access_key }}"
|
|
||||||
ansible_aws_ssm_secret_access_key: "{{ aws_secret_key }}"
|
|
||||||
tasks:
|
|
||||||
- name: Fetch image.
|
|
||||||
amazon.aws.s3_object:
|
|
||||||
mode: get
|
|
||||||
bucket: "{{ image_bucket }}"
|
|
||||||
object: "{{ image_key }}"
|
|
||||||
dest: /root/image.tar.gz
|
|
||||||
|
|
||||||
region: "{{ aws_region }}"
|
|
||||||
access_key: "{{ aws_access_key }}"
|
|
||||||
secret_key: "{{ aws_secret_key }}"
|
|
||||||
|
|
||||||
- name: Create data directory.
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: /home/ssm-user/data
|
|
||||||
state: directory
|
|
||||||
mode: '0777'
|
|
||||||
|
|
||||||
- name: Load image.
|
|
||||||
community.docker.docker_image_load:
|
|
||||||
path: /root/image.tar.gz
|
|
||||||
register: image
|
|
||||||
|
|
||||||
- name: Run image.
|
|
||||||
community.docker.docker_container:
|
|
||||||
name: server
|
|
||||||
image: "{{ image.image_names[0] }}"
|
|
||||||
state: started
|
|
||||||
recreate: true
|
|
||||||
restart_policy: unless-stopped
|
|
||||||
memory: 425m
|
|
||||||
memory_swap: 900m
|
|
||||||
ports: [80:80, 2222:2222, 443:443, "22:22"]
|
|
||||||
env:
|
|
||||||
GITEA__security__INTERNAL_TOKEN: "{{ internal_secret }}"
|
|
||||||
GITEA__server__LFS_JWT_SECRET: "{{ lfs_secret }}"
|
|
||||||
GITEA__oauth2__JWT_SECRET: "{{ jwt_secret }}"
|
|
||||||
GITEA__server__ACME_EMAIL: "{{ email }}"
|
|
||||||
GITEA__server__SSH_DOMAIN: "{{ full_domain.value }}"
|
|
||||||
GITEA__server__DOMAIN: "{{ full_domain.value }}"
|
|
||||||
GITEA__server__ROOT_URL: "https://{{ full_domain.value }}/"
|
|
||||||
GITEA__storage__MINIO_ACCESS_KEY_ID: "{{ minio_access_key }}"
|
|
||||||
GITEA__storage__MINIO_SECRET_ACCESS_KEY: "{{ minio_secret_key }}"
|
|
||||||
labels:
|
|
||||||
docker-volume-backup.stop-during-backup: "true"
|
|
||||||
volumes:
|
|
||||||
- /home/ssm-user/data:/var/lib/gitea
|
|
||||||
- /etc/timezone:/etc/timezone:ro
|
|
||||||
- /etc/localtime:/etc/localtime:ro
|
|
||||||
|
|
||||||
- name: Run backup.
|
|
||||||
community.docker.docker_container:
|
|
||||||
name: backup
|
|
||||||
image: offen/docker-volume-backup:v2
|
|
||||||
state: started
|
|
||||||
recreate: true
|
|
||||||
restart_policy: unless-stopped
|
|
||||||
volumes:
|
|
||||||
- /home/ssm-user/data:/backup/my-app-backup:ro
|
|
||||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
||||||
env:
|
|
||||||
AWS_S3_BUCKET_NAME: "{{ boot_bucket }}"
|
|
||||||
AWS_S3_PATH: "{{ boot_key }}"
|
|
||||||
AWS_REGION: "{{ boot_region.value }}"
|
|
||||||
AWS_ACCESS_KEY_ID: "{{ boot_id.value }}"
|
|
||||||
AWS_SECRET_ACCESS_KEY: "{{ boot_secret.value }}"
|
|
||||||
BACKUP_CRON_EXPRESSION: "0 0 * * *"
|
|
||||||
36
terraform/.terraform.lock.hcl
generated
36
terraform/.terraform.lock.hcl
generated
@@ -1,24 +1,24 @@
|
|||||||
# This file is maintained automatically by "terraform init".
|
# This file is maintained automatically by "terraform init".
|
||||||
# Manual edits may be lost in future updates.
|
# Manual edits may be lost in future updates.
|
||||||
|
|
||||||
provider "registry.terraform.io/hashicorp/aws" {
|
provider "registry.terraform.io/hetznercloud/hcloud" {
|
||||||
version = "5.83.1"
|
version = "1.52.0"
|
||||||
|
constraints = "~> 1.45"
|
||||||
hashes = [
|
hashes = [
|
||||||
"h1:Yy3K7R7881H72rQDzG6qjZVkrWA6DGJzfE21TionY7w=",
|
"h1:LTjrLuC+4F1Kv4TxS9e7LVVkG8/S4QQ7X4ORblvKTbc=",
|
||||||
"zh:0313253c78f195973752c4d1f62bfdd345a9c99c1bc7a612a8c1f1e27d51e49e",
|
"zh:1e9bb6b6a2ea5f441638dbae2d60fbe04ff455f58a18c740b8b7913e2197d875",
|
||||||
"zh:108523f3e9ebc93f7d900c51681f6edbd3f3a56b8a62b0afc31d8214892f91e0",
|
"zh:29c122e404ba331cfbadacc7f1294de5a31c9dfd60bdfe3e1b402271fc8e419c",
|
||||||
"zh:175b9bf2a00bea6ac1c73796ad77b0e00dcbbde166235017c49377d7763861d8",
|
"zh:2bd0ae2f0bb9f16b7753f59a08e57ac7230f9c471278d7882f81406b9426c8c7",
|
||||||
"zh:1c8bf55b8548bbad683cd6d7bdb03e8840a00b2422dc1529ffb9892820657130",
|
"zh:4383206971873f6b5d81580a9a36e0158924f5816ebb6206b0cf2430e4e6a609",
|
||||||
"zh:22338f09bae62d5ff646de00182417f992548da534fee7d98c5d0136d4bd5d7a",
|
"zh:47e2ca1cfa18500e4952ab51dc357a0450d00a92da9ea03e452f1f3efe6bbf75",
|
||||||
"zh:92de1107ec43de60612be5f6255616f16a9cf82d88df1af1c0471b81f3a82c16",
|
"zh:8e9fe90e3cea29bb7892b64da737642fc22b0106402df76c228a3cbe99663278",
|
||||||
"zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
|
"zh:a2d69350a69c471ddb63bcc74e105e585319a0fc0f4d1b7f70569f6d2ece5824",
|
||||||
"zh:9c7bfb7afea330e6d90e1466125a8cba3db1ed4043c5da52f737459c89290a6e",
|
"zh:a97abcc254e21c294e2d6b0fc9068acfd63614b097dda365f1c56ea8b0fd5f6b",
|
||||||
"zh:ba59b374d477e5610674b70f5abfe0408e8f809390347372751384151440d3d0",
|
"zh:aba8d72d4fe2e89c922d5446d329e5c23d00b28227b4666e6486ba18ea2ec278",
|
||||||
"zh:bd1c433966002f586d63cb1e3e16326991f238bc6beeb2352be36ec651917b0b",
|
"zh:ad36c333978c2d9e4bc43dcadcbff42fe771a8c5ef53d028bcacec8287bf78a7",
|
||||||
"zh:ca2b4d1d02651c15261fffa4b142e45def9a22c6069353f0f663fd2046e268f8",
|
"zh:cdb1e6903b9d2f0ad8845d4eb390fbe724ee2435fb045baeab38d4319e637682",
|
||||||
"zh:d8ed98c748f7a3f1a72277cfee9afe346aca39ab319d17402277852551d8f14a",
|
"zh:df77b08757f3f36b8aadb33d73362320174047044414325c56a87983f48b5186",
|
||||||
"zh:ed3d8bc89de5f35f3c5f4802ff7c749fda2e2be267f9af4a850694f099960a72",
|
"zh:e07513d5ad387247092b5ae1c87e21a387fc51873b3f38eee616187e38b090a7",
|
||||||
"zh:f698732a4391c3f4d7079b4aaa52389da2a460cac5eed438ed688f147d603689",
|
"zh:e2be02bdc59343ff4b9e26c3b93db7680aaf3e6ed13c8c4c4b144c74c2689915",
|
||||||
"zh:f9f51b17f2978394954e9f6ab9ef293b8e11f1443117294ccf87f7f8212b3439",
|
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,18 +0,0 @@
|
|||||||
version: 3
|
|
||||||
silent: true
|
|
||||||
|
|
||||||
vars:
|
|
||||||
BACKEND: ../config/backend.secret.json
|
|
||||||
VARIABLES: ../config/variables.secret.json
|
|
||||||
OUTPUT: ../config/infrastructure.secret.json
|
|
||||||
|
|
||||||
tasks:
|
|
||||||
init: terraform init -backend-config={{.BACKEND}}
|
|
||||||
plan: terraform plan -var-file={{.VARIABLES}}
|
|
||||||
destroy: terraform destroy
|
|
||||||
format: terraform fmt -recursive
|
|
||||||
out: terraform output -json > {{.OUTPUT}}
|
|
||||||
apply:
|
|
||||||
- terraform apply -var-file={{.VARIABLES}}
|
|
||||||
- task: out
|
|
||||||
import: terraform import -var-file={{.VARIABLES}} {{.CLI_ARGS}}
|
|
||||||
@@ -1,31 +0,0 @@
|
|||||||
data "aws_s3_bucket" "storage_bucket" {
|
|
||||||
bucket = var.boot_bucket
|
|
||||||
}
|
|
||||||
|
|
||||||
data "aws_iam_policy_document" "boot" {
|
|
||||||
statement {
|
|
||||||
effect = "Allow"
|
|
||||||
actions = ["s3:*", "s3-object-lambda:*"]
|
|
||||||
resources = [
|
|
||||||
"${data.aws_s3_bucket.storage_bucket.arn}/${var.boot_key}",
|
|
||||||
"${data.aws_s3_bucket.storage_bucket.arn}/${var.boot_key}/*",
|
|
||||||
]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
resource "aws_iam_policy" "boot" {
|
|
||||||
name = "${var.boot_role}Policy"
|
|
||||||
description = "The policy that manages the Gitea Boot."
|
|
||||||
|
|
||||||
policy = data.aws_iam_policy_document.boot.json
|
|
||||||
}
|
|
||||||
|
|
||||||
module "boot_user" {
|
|
||||||
source = "terraform-aws-modules/iam/aws//modules/iam-user"
|
|
||||||
version = "5.52.2"
|
|
||||||
|
|
||||||
create_iam_user_login_profile = false
|
|
||||||
name = "${var.boot_role}User"
|
|
||||||
password_reset_required = false
|
|
||||||
policy_arns = [aws_iam_policy.boot.arn]
|
|
||||||
}
|
|
||||||
@@ -1,43 +1,24 @@
|
|||||||
# An elastic IP, so if the reverse proxy is modified, the route tables won't.
|
resource "hcloud_primary_ip" "public_ip" {
|
||||||
resource "aws_eip" "public" {
|
name = "repository-public-ip"
|
||||||
instance = aws_instance.this.id
|
datacenter = local.datacenter
|
||||||
domain = "vpc"
|
type = "ipv4"
|
||||||
|
assignee_type = "server"
|
||||||
|
auto_delete = false
|
||||||
}
|
}
|
||||||
|
|
||||||
# An instance profile for access via AWS SSM.
|
resource "hcloud_ssh_key" "ssky_key" {
|
||||||
resource "aws_iam_instance_profile" "ssm" {
|
name = "repository-ssh-key"
|
||||||
name = "SSMInstanceProfile"
|
public_key = file(var.public_ssh_key_path)
|
||||||
role = "AmazonSSMRoleForInstancesQuickSetup"
|
|
||||||
}
|
}
|
||||||
|
|
||||||
# The Gitea instance.
|
resource "hcloud_server" "server_test" {
|
||||||
resource "aws_instance" "this" {
|
name = "repository-server"
|
||||||
# ami = data.aws_ami.amazon-linux-2.id
|
image = local.server_image
|
||||||
ami = "ami-0adec96dc0cdc7bca"
|
server_type = local.server_type
|
||||||
instance_type = "t4g.nano"
|
datacenter = local.datacenter
|
||||||
subnet_id = module.vpc.public_subnets[0]
|
public_net {
|
||||||
|
ipv4_enabled = true
|
||||||
user_data = file("install.sh")
|
ipv4 = hcloud_primary_ip.public_ip.id
|
||||||
user_data_replace_on_change = true
|
ipv6_enabled = false
|
||||||
|
|
||||||
iam_instance_profile = aws_iam_instance_profile.ssm.name
|
|
||||||
vpc_security_group_ids = [aws_security_group.public_access.id]
|
|
||||||
|
|
||||||
metadata_options {
|
|
||||||
http_tokens = "required"
|
|
||||||
}
|
}
|
||||||
|
}
|
||||||
root_block_device {
|
|
||||||
volume_type = "gp3"
|
|
||||||
volume_size = 8
|
|
||||||
}
|
|
||||||
|
|
||||||
tags = {
|
|
||||||
Name = "Codebase: Gitea"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
resource "aws_ec2_instance_state" "this" {
|
|
||||||
instance_id = aws_instance.this.id
|
|
||||||
state = "running"
|
|
||||||
}
|
|
||||||
@@ -1,55 +0,0 @@
|
|||||||
locals {
|
|
||||||
# The IP block for the VPC.
|
|
||||||
vpc_cidr = "10.0.0.0/16"
|
|
||||||
}
|
|
||||||
|
|
||||||
data "aws_availability_zones" "all" {}
|
|
||||||
|
|
||||||
# The main VPC.
|
|
||||||
module "vpc" {
|
|
||||||
source = "terraform-aws-modules/vpc/aws"
|
|
||||||
|
|
||||||
name = "Main"
|
|
||||||
cidr = local.vpc_cidr
|
|
||||||
|
|
||||||
azs = [data.aws_availability_zones.all.names[0]]
|
|
||||||
private_subnets = [cidrsubnet(local.vpc_cidr, 8, 0)]
|
|
||||||
public_subnets = [cidrsubnet(local.vpc_cidr, 8, 4)]
|
|
||||||
|
|
||||||
private_subnet_tags = { SubnetOf = "Main", SubnetType = "Private" }
|
|
||||||
public_subnet_tags = { SubnetOf = "Main", SubnetType = "Public" }
|
|
||||||
|
|
||||||
map_public_ip_on_launch = true
|
|
||||||
enable_dns_hostnames = true
|
|
||||||
enable_dns_support = true
|
|
||||||
|
|
||||||
private_route_table_tags = { TableOf = "Main", TableType = "Public" }
|
|
||||||
}
|
|
||||||
|
|
||||||
# Only allow HTTP(s) and SSH traffic. Allow full access to internet.
|
|
||||||
resource "aws_security_group" "public_access" {
|
|
||||||
vpc_id = module.vpc.vpc_id
|
|
||||||
tags = { GroupOf = "Main", GroupType = "Public" }
|
|
||||||
}
|
|
||||||
|
|
||||||
resource "aws_vpc_security_group_ingress_rule" "ingress" {
|
|
||||||
for_each = toset(["80", "443", "22", "2222", "81", "8080", "4321", "1234"])
|
|
||||||
|
|
||||||
security_group_id = aws_security_group.public_access.id
|
|
||||||
|
|
||||||
from_port = each.value
|
|
||||||
to_port = each.value
|
|
||||||
ip_protocol = "tcp"
|
|
||||||
cidr_ipv4 = "0.0.0.0/0"
|
|
||||||
}
|
|
||||||
|
|
||||||
resource "aws_vpc_security_group_egress_rule" "egress" {
|
|
||||||
for_each = toset(["-1"])
|
|
||||||
|
|
||||||
security_group_id = aws_security_group.public_access.id
|
|
||||||
|
|
||||||
from_port = each.value
|
|
||||||
to_port = each.value
|
|
||||||
ip_protocol = "-1"
|
|
||||||
cidr_ipv4 = "0.0.0.0/0"
|
|
||||||
}
|
|
||||||
@@ -1,33 +0,0 @@
|
|||||||
output "instance_id" {
|
|
||||||
value = aws_instance.this.id
|
|
||||||
description = "The instance ID of the Gitea instance."
|
|
||||||
}
|
|
||||||
|
|
||||||
output "ip_address" {
|
|
||||||
value = aws_instance.this.private_ip
|
|
||||||
description = "The Gitea IP address."
|
|
||||||
}
|
|
||||||
|
|
||||||
output "boot_region" {
|
|
||||||
value = var.aws_region
|
|
||||||
description = "The region to manipulate the codebase repository boot."
|
|
||||||
sensitive = true
|
|
||||||
}
|
|
||||||
|
|
||||||
output "boot_id" {
|
|
||||||
value = module.boot_user.iam_access_key_id
|
|
||||||
description = "The access id to manipulate the codebase repository boot."
|
|
||||||
sensitive = true
|
|
||||||
}
|
|
||||||
|
|
||||||
output "boot_secret" {
|
|
||||||
value = module.boot_user.iam_access_key_secret
|
|
||||||
description = "The access secret to manipulate the codebase repository boot."
|
|
||||||
sensitive = true
|
|
||||||
}
|
|
||||||
|
|
||||||
output "full_domain" {
|
|
||||||
value = "${var.subdomain}.${var.domain}"
|
|
||||||
description = "The domain of the Gitea instance."
|
|
||||||
sensitive = true
|
|
||||||
}
|
|
||||||
@@ -1,11 +1,18 @@
|
|||||||
terraform {
|
terraform {
|
||||||
# The backend is stored in an S3 bucket.
|
backend "s3" {
|
||||||
backend "s3" {}
|
skip_credentials_validation = true
|
||||||
|
skip_region_validation = true
|
||||||
|
skip_requesting_account_id = true
|
||||||
|
}
|
||||||
|
|
||||||
|
required_providers {
|
||||||
|
hcloud = {
|
||||||
|
source = "hetznercloud/hcloud"
|
||||||
|
version = "~> 1.45"
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
# Access AWS through the IaC roles.
|
provider "hcloud" {
|
||||||
provider "aws" {
|
token = var.hcloud_token
|
||||||
region = var.aws_region
|
}
|
||||||
access_key = var.aws_access
|
|
||||||
secret_key = var.aws_secret
|
|
||||||
}
|
|
||||||
|
|||||||
@@ -1,13 +0,0 @@
|
|||||||
# The Route53 DNS zone.
|
|
||||||
data "aws_route53_zone" "main" {
|
|
||||||
name = var.domain
|
|
||||||
}
|
|
||||||
|
|
||||||
# Push all domain traffic through the reverse proxy.
|
|
||||||
resource "aws_route53_record" "domain" {
|
|
||||||
zone_id = data.aws_route53_zone.main.zone_id
|
|
||||||
name = "${var.subdomain}.${data.aws_route53_zone.main.name}"
|
|
||||||
type = "A"
|
|
||||||
ttl = "60"
|
|
||||||
records = [aws_eip.public.public_ip]
|
|
||||||
}
|
|
||||||
@@ -1,39 +1,16 @@
|
|||||||
variable "aws_region" {
|
variable "hcloud_token" {
|
||||||
type = string
|
sensitive = true
|
||||||
description = "The AWS region things are created in."
|
description = "The hCloud token used to access Hetzner resources."
|
||||||
|
type = string
|
||||||
}
|
}
|
||||||
|
|
||||||
variable "aws_access" {
|
variable "public_ssh_key_path" {
|
||||||
type = string
|
description = "The location of the public key used to access the repository server."
|
||||||
description = "The access key to generate the Gitea instance."
|
type = string
|
||||||
}
|
}
|
||||||
|
|
||||||
variable "aws_secret" {
|
locals {
|
||||||
type = string
|
datacenter = "fsn1-dc14"
|
||||||
description = "The access secret to generate the Gitea instance."
|
server_type = "cx22"
|
||||||
}
|
server_image = "debian-12"
|
||||||
|
}
|
||||||
variable "boot_bucket" {
|
|
||||||
type = string
|
|
||||||
description = "The name of the bucket to store the boot in."
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "boot_key" {
|
|
||||||
type = string
|
|
||||||
description = "The path that will hold the boot data."
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "boot_role" {
|
|
||||||
type = string
|
|
||||||
description = "The name of the role for boot access."
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "domain" {
|
|
||||||
type = string
|
|
||||||
description = "The name of the domain."
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "subdomain" {
|
|
||||||
type = string
|
|
||||||
description = "The name of the subdomain."
|
|
||||||
}
|
|
||||||
31
vault.yml
31
vault.yml
@@ -1,6 +1,27 @@
|
|||||||
$ANSIBLE_VAULT;1.1;AES256
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
38656161656531643430306264373465643164656338326333333365646666336364303939383330
|
38323339316264326632393865326536613866323232396239306431386339326431316637343431
|
||||||
3730613865373335386631313931656438396435366330610a663837343033643964356333653663
|
6537323139653664383461393937656332666136373333370a373964396538643439376633316437
|
||||||
66643062653936343031336432663064663831313430346464643534316538616638333965386531
|
32613563306661323830376135623466626636316433323866396230313566653933386162366131
|
||||||
3834373335663766380a396534363833653163373635353037623337336637303962303733396439
|
3562343139653337660a366136623834613564633964306662326336306334646264643365623864
|
||||||
6631
|
33303965326234373235386230353464393061356639303438636535626330333064353863623030
|
||||||
|
33383539323136333939303939313734636137376637636638643334663962653061633930386262
|
||||||
|
39333766613031343861376639303636363763663431363538633566616366653632633262336362
|
||||||
|
32666463336665653135316266393231323264303163646336343962633537643534353632363637
|
||||||
|
30643831303866376634383939623439633530653330353839663037313731306163633938303961
|
||||||
|
66313735353831376366323635653063343262343337666537633766633037313765386237383134
|
||||||
|
62343234356635653733633461613232333935396363666631653638363961376362643932643135
|
||||||
|
65626463323265623863663766613865326664653863643032303464333939363739656238383732
|
||||||
|
37343936666238333130323263666131363833616261633936623833353565353332666638316232
|
||||||
|
66343064386265313830306163366533313035343261383037646666366532313565643762363432
|
||||||
|
33646161376236363932326532393935363736643732373838633035653565376466663538393132
|
||||||
|
33646436666463356330386337633636373961323031343065303638323439623034333031323135
|
||||||
|
30663362393539396366656634353166636533303562376232643733303434376565323936316638
|
||||||
|
36353338373664386331303532633063383166646332326562303830353264386335663363326262
|
||||||
|
32666161633134626162636463663364316139623234383531343363316566633336633238323434
|
||||||
|
62613634663465356238666238356164636231343938643064333466343135333032623435396230
|
||||||
|
64323265633537333538343363656438333764623532366431643263396263303966326264373139
|
||||||
|
38346138643866666233313162346431656131653137373562333234626263313332363366626130
|
||||||
|
65316338363465323435373638353266366331663535643733353565303565353730346462633265
|
||||||
|
33396637353939303335383634623732633565643964316233373962316530623232313663666266
|
||||||
|
33353463633661633831323830303864363863306330313261356464383231373163383231393631
|
||||||
|
3037376236613365393332666331613263333936616362616639
|
||||||
|
|||||||
Reference in New Issue
Block a user