feat: gitea now standalone

terraform/iam.tf

@@ -6,7 +6,10 @@ data "aws_iam_policy_document" "boot" {
   statement {
     effect    = "Allow"
     actions   = ["s3:*", "s3-object-lambda:*"]
-    resources = ["${data.aws_s3_bucket.storage_bucket.arn}/${var.boot_key}"]
+    resources = [
+      "${data.aws_s3_bucket.storage_bucket.arn}/${var.boot_key}",
+      "${data.aws_s3_bucket.storage_bucket.arn}/${var.boot_key}/*",
+    ]
   }
 }
 
@@ -22,7 +25,7 @@ module "boot_user" {
   version = "5.52.2"
 
   create_iam_user_login_profile = false
-  name = "${var.boot_role}User"
-  password_reset_required = false
-  policy_arns = [aws_iam_policy.boot.arn]
+  name                          = "${var.boot_role}User"
+  password_reset_required       = false
+  policy_arns                   = [aws_iam_policy.boot.arn]
 }

terraform/install.sh

@@ -1,5 +1,6 @@
 #!/bin/sh
 
+rpm --rebuilddb
 amazon-linux-extras install docker ansible2 python3.8 -y
 
 # Make Docker work.
@@ -10,7 +11,7 @@ sudo usermod -aG docker ssm-user
 # Set up the correct version of Python (for Ansible).
 ln -sf /usr/bin/python3.8 /usr/bin/python3
 ln -sf /usr/bin/pip3.8 /usr/bin/pip3
-pip3 install botocore boto3 requests
+pip3 install botocore boto3 requests packaging
 python3 -m pip install -U pip
 
 # Add some swap space.
@@ -20,9 +21,8 @@ mkswap /swapfile
 swapon /swapfile
 
 # Stop SSH (because we have SSM.)
-sudo service sshd stop
+service sshd stop
 
 # Install Docker Compose.
 curl -L "https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
 chmod +x /usr/local/bin/docker-compose
-docker-compose version

terraform/main.tf

@@ -1,3 +1,9 @@
+# An elastic IP, so if the reverse proxy is modified, the route tables won't.
+resource "aws_eip" "public" {
+  instance = aws_instance.gitea.id
+  domain   = "vpc"
+}
+
 data "aws_iam_instance_profile" "ssm" {
   name = "SSMInstanceProfile"
 }
@@ -7,12 +13,13 @@ resource "aws_instance" "gitea" {
   # ami           = data.aws_ami.amazon-linux-2.id
   ami           = "ami-0adec96dc0cdc7bca"
   instance_type = "t4g.nano"
-  subnet_id     = data.aws_subnet.subnet.id
+  subnet_id     = module.vpc.public_subnets[0]
 
   user_data                   = file("install.sh")
   user_data_replace_on_change = true
 
-  iam_instance_profile = data.aws_iam_instance_profile.ssm.name
+  iam_instance_profile   = data.aws_iam_instance_profile.ssm.name
+  vpc_security_group_ids = [aws_security_group.public_access.id]
 
   root_block_device {
     volume_type = "gp3"
@@ -22,4 +29,4 @@ resource "aws_instance" "gitea" {
   tags = {
     Name = "Codebase: Gitea"
   }
-}
+}

terraform/network.tf

@@ -1,6 +1,55 @@
-data "aws_subnet" "subnet" {
-  tags = {
-    SubnetType = "Private"
-    SubnetOf = "Main"
-  }
+locals {
+  # The IP block for the VPC.
+  vpc_cidr = "10.0.0.0/16"
+
+  # Here is the domain name changes.
+  domain_name = "maximhutz.com"
 }
+
+data "aws_availability_zones" "all" {}
+
+# The main VPC.
+module "vpc" {
+  source = "terraform-aws-modules/vpc/aws"
+
+  name = "Main"
+  cidr = local.vpc_cidr
+
+  azs             = [data.aws_availability_zones.all.names[0]]
+  private_subnets = [cidrsubnet(local.vpc_cidr, 8, 0)]
+  public_subnets  = [cidrsubnet(local.vpc_cidr, 8, 4)]
+
+  private_subnet_tags = { SubnetOf = "Main", SubnetType = "Private" }
+  public_subnet_tags = { SubnetOf = "Main", SubnetType = "Public" }
+
+  map_public_ip_on_launch = true
+  enable_dns_hostnames    = true
+  enable_dns_support      = true
+}
+
+# Only allow HTTP(s) and SSH traffic. Allow full access to internet.
+resource "aws_security_group" "public_access" {
+  vpc_id = module.vpc.vpc_id
+}
+
+resource "aws_vpc_security_group_ingress_rule" "ingress" {
+  for_each = toset(["80", "443", "22", "2222", "81", "8080", "4321", "1234"])
+
+  security_group_id = aws_security_group.public_access.id
+
+  from_port   = each.value
+  to_port     = each.value
+  ip_protocol = "tcp"
+  cidr_ipv4   = "0.0.0.0/0"
+}
+
+resource "aws_vpc_security_group_egress_rule" "egress" {
+  for_each = toset(["-1"])
+
+  security_group_id = aws_security_group.public_access.id
+
+  from_port   = each.value
+  to_port     = each.value
+  ip_protocol = "-1"
+  cidr_ipv4   = "0.0.0.0/0"
+}

terraform/routing.tf

@@ -0,0 +1,13 @@
+# The Route53 DNS zone.
+data "aws_route53_zone" "main" {
+  name = local.domain_name
+}
+
+# Push all domain traffic through the reverse proxy.
+resource "aws_route53_record" "domain" {
+  zone_id = data.aws_route53_zone.main.zone_id
+  name    = "code.${data.aws_route53_zone.main.name}"
+  type    = "A"
+  ttl     = "60"
+  records = [aws_eip.public.public_ip]
+}