feat: gitea works!

Taskfile.yml

@@ -8,5 +8,5 @@ tasks:
   enter:
     cmd: ssh -i {{.KEY}} -p 2222 root@{{.IP}}
     vars:
-      KEY: { sh: ansible-vault view vault.yml | yq -r ".deploy.private_ssh_key_path" }
+      KEY: { sh: ansible-vault view vault.yml | yq -r ".secret.private_ssh_key_path" }
       IP: { sh: cat dist/terraform_outputs.yml | jq -r ".server_ip.value" }

gitea/Containerfile.dev

@@ -1,13 +0,0 @@
-FROM gitea/gitea:latest-rootless
-
-ADD --chown=git:git config /etc/gitea
-ADD --chown=git:git custom /etc/gitea-custom
-
-ENV GITEA_CUSTOM=/etc/gitea-custom
-
-RUN rm /etc/gitea/app.ini
-RUN mv /etc/gitea/dev.app.ini /etc/gitea/app.ini
-
-WORKDIR /etc/gitea-custom
-
-RUN gitea cert --host localhost --ca

gitea/config/app.ini

@@ -97,7 +97,5 @@ DEFAULT_TRUST_MODEL = committer
 
 [storage]
 STORAGE_TYPE = minio
-MINIO_ENDPOINT = s3.us-east-1.amazonaws.com
-MINIO_BUCKET = myrica-faya
 MINIO_USE_SSL = true
 MINIO_INSECURE_SKIP_VERIFY = false

playbooks/deploy.yml

@@ -11,7 +11,7 @@
         ansible_ssh_host: "{{ server_ip.value }}"
         ansible_user: root
         ansible_port: 22
-        ansible_private_key_file: "{{ deploy.private_ssh_key_path }}"
+        ansible_private_key_file: "{{ secret.private_ssh_key_path }}"
 
 - name: Switch port to 2222.
   hosts: server_fresh
@@ -42,7 +42,7 @@
         ansible_ssh_host: "{{ server_ip.value }}"
         ansible_user: root
         ansible_port: 2222
-        ansible_private_key_file: "{{ deploy.private_ssh_key_path }}"
+        ansible_private_key_file: "{{ secret.private_ssh_key_path }}"
 
 - name: Install Docker.
   gather_facts: true
@@ -89,3 +89,80 @@
           - containerd.io
           - docker-buildx-plugin
           - docker-compose-plugin
+
+- name: Deploy artifact to instance.
+  hosts: server
+  gather_facts: false
+  vars_files:
+    - ../variables.yml
+    - ../vault.yml
+    - ../dist/terraform_outputs.yml
+  tasks:
+    - name: Copy gitea folder.
+      ansible.builtin.copy:
+        src: ../gitea/
+        dest: /root/gitea/
+        mode: preserve
+
+    - name: Build image.
+      community.docker.docker_image_build:
+        name: "{{ variables.image_name }}"
+        path: /root/gitea
+        nocache: true
+        rebuild: always
+        pull: true
+
+    - name: Create data directory.
+      ansible.builtin.file:
+        path: /root/data
+        state: directory
+        mode: '0777'
+
+    - name: Run image.
+      community.docker.docker_container:
+        name: server
+        image: "{{ variables.image_name }}"
+        state: started
+        recreate: true
+        restart_policy: unless-stopped
+        memory: 425m
+        memory_swap: 900m
+        ports: [80:80, 443:443, "22:22"]
+        env:
+          GITEA__security__INTERNAL_TOKEN: "{{ secret.internal }}"
+          GITEA__server__LFS_JWT_SECRET: "{{ secret.lfs }}"
+          GITEA__oauth2__JWT_SECRET: "{{ secret.jwt }}"
+          GITEA__server__ACME_EMAIL: "acme@maximhutz.me"
+          GITEA__server__SSH_DOMAIN: "{{ server_fqdn.value }}"
+          GITEA__server__DOMAIN: "{{ server_fqdn.value }}"
+          GITEA__server__ROOT_URL: "https://{{ server_fqdn.value }}/"
+
+          GITEA__storage__MINIO_BUCKET: "{{ secret.bucket.name }}"
+          GITEA__storage__MINIO_ENDPOINT: "{{ secret.bucket.endpoint }}"
+          GITEA__storage__MINIO_ACCESS_KEY_ID: "{{ secret.bucket.access_key }}"
+          GITEA__storage__MINIO_SECRET_ACCESS_KEY: "{{ secret.bucket.secret_key }}"
+        labels:
+          docker-volume-backup.stop-during-backup: "true"
+        volumes:
+          - /root/data:/var/lib/gitea
+          - /etc/timezone:/etc/timezone:ro
+          - /etc/localtime:/etc/localtime:ro
+
+    - name: Run backup.
+      community.docker.docker_container:
+        name: backup
+        image: offen/docker-volume-backup:v2
+        state: started
+        recreate: true
+        restart_policy: unless-stopped
+        volumes:
+          - /root/data:/backup/my-app-backup:ro
+          - /var/run/docker.sock:/var/run/docker.sock:ro
+        env:
+          AWS_S3_BUCKET_NAME: "{{ secret.bucket.name }}"
+          AWS_S3_PATH: "{{ secret.backup.key }}"
+          AWS_REGION: "{{ secret.bucket.region }}"
+          AWS_ACCESS_KEY_ID: "{{ secret.bucket.access_key }}"
+          AWS_SECRET_ACCESS_KEY: "{{ secret.bucket.secret_key }}"
+          AWS_ENDPOINT: "{{ secret.bucket.endpoint }}"
+          BACKUP_CRON_EXPRESSION: "0 0 * * *"

terraform/.terraform.lock.hcl

@@ -1,6 +1,28 @@
 # This file is maintained automatically by "terraform init".
 # Manual edits may be lost in future updates.
 
+provider "registry.terraform.io/hashicorp/aws" {
+  version = "6.12.0"
+  hashes = [
+    "h1:8u90EMle+I3Auh4f/LPP6fEfRsAF6xCFnUZF4b7ngEs=",
+    "zh:054bcbf13c6ac9ddd2247876f82f9b56493e2f71d8c88baeec142386a395165d",
+    "zh:195489f16ad5621db2cec80be997d33060462a3b8d442c890bef3eceba34fa4d",
+    "zh:3461ef14904ab7de246296e44d24c042f3190e6bead3d7ce1d9fda63dcb0f047",
+    "zh:44517a0035996431e4127f45db5a84f53ce80730eae35629eda3101709df1e5c",
+    "zh:4b0374abaa6b9a9debed563380cc944873e4f30771dd1da7b9e812a49bf485e3",
+    "zh:531468b99465bd98a89a4ce2f1a30168dfadf6edb57f7836df8a977a2c4f9804",
+    "zh:6a95ed7b4852174aa748d3412bff3d45e4d7420d12659f981c3d9f4a1a59a35f",
+    "zh:88c2d21af1e64eed4a13dbb85590c66a519f3ecc54b72875d4bb6326f3ef84e7",
+    "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
+    "zh:a8b648470bb5df098e56b1ec5c6a39e0bbb7b496b23a19ea9f494bf48d4a122a",
+    "zh:b23fb13efdb527677db546bc92aeb2bdf64ff3f480188841f2bfdfa7d3d907c1",
+    "zh:be5858a1951ae5f5a9c388949c3e3c66a3375f684fb79b06b1d1db7a9703b18e",
+    "zh:c368e03a7c922493daf4c7348faafc45f455225815ef218b5491c46cea5f76b7",
+    "zh:e31e75d5d19b8ac08aa01be7e78207966e1faa3b82ed9fe3acfdc2d806be924c",
+    "zh:ea84182343b5fd9252a6fae41e844eed4fdc3311473a753b09f06e49ec0e7853",
+  ]
+}
+
 provider "registry.terraform.io/hetznercloud/hcloud" {
   version     = "1.52.0"
   constraints = "~> 1.45"

terraform/outputs.tf

@@ -3,3 +3,9 @@ output "server_ip" {
   value = hcloud_server.server_instance.ipv4_address
   sensitive = false
 }
+
+output "server_fqdn" {
+  description = "The public domain of the server."
+  value = "${local.subdomain}.${local.domain}"
+  sensitive = false
+}

terraform/providers.tf

@@ -16,3 +16,9 @@ terraform {
 provider "hcloud" {
   token = var.hcloud_token
 }
+
+provider "aws" {
+  region     = var.aws_region
+  access_key = var.aws_access_key
+  secret_key = var.aws_secret_key
+}

terraform/routing.tf

@@ -0,0 +1,13 @@
+# The Route53 DNS zone.
+data "aws_route53_zone" "main" {
+  name = local.domain
+}
+
+# Push all domain traffic through the reverse proxy.
+resource "aws_route53_record" "domain" {
+  zone_id = data.aws_route53_zone.main.zone_id
+  name    = "${local.subdomain}.${data.aws_route53_zone.main.name}"
+  type    = "A"
+  ttl     = "60"
+  records = [hcloud_primary_ip.public_ip.ip_address]
+}

terraform/variables.tf

@@ -1,3 +1,14 @@
+locals {
+  datacenter = "fsn1-dc14"
+  server_type = "cx22"
+  server_image = "debian-12"
+
+  domain = "maximhutz.com"
+  subdomain = "git2"
+}
+
+# ---------------------------------------------------------------------------- #
+
 variable "hcloud_token" {
   sensitive = true
   description = "The hCloud token used to access Hetzner resources."
@@ -9,8 +20,20 @@ variable "public_ssh_key_path" {
   type = string
 }
 
-locals {
-  datacenter = "fsn1-dc14"
-  server_type = "cx22"
-  server_image = "debian-12"
+variable "aws_region" {
+  description = "The region of the AWS account."
+  type = string
+  sensitive = true
+}
+
+variable "aws_access_key" {
+  description = "The access key of the account."
+  type = string
+  sensitive = true
+}
+
+variable "aws_secret_key" {
+  description = "The secret key of the account."
+  type = string
+  sensitive = true
 }

variables.yml

@@ -0,0 +1,2 @@
+variables:
+  image_name: mvhutz/gitea

vault.yml

@@ -1,30 +1,54 @@
 $ANSIBLE_VAULT;1.1;AES256
-34643530383765643831323664663862643337623238343461366330376462326636383935333036
-6537343334303666336163363965303035613437333235650a346434356437323964376262663834
-61373330643932363061393039373064306262373738303934393437333934653434626434373362
-6265383464376133650a333162373362323261353163646566653733626533613863323237633833
-36616463396535366436356662306333383134653233323334303639336439653732326534313161
-38353463643563363631346537653133353165376438336131323662376263356662366233343337
-61333961653339316332653630666633323635353135303633316635326430373630653464343765
-66613938663762326462353563323138356466653966383336633962613639633638363561353836
-32376161343131323262643831653965333338346263643463613238626231383364626431386636
-34636330663261303664656534353934656135306164353864623236396530323366363666623832
-36386666383434336265623262626566626464363163663332623562393330653137333062353665
-39623233626130613263653434613066393831383931666138373066323336663066646230623738
-30613139663838623632376137343935353739626239303034633766363239383333633035653365
-39316665633536323238393930646461623363613964393132353636633663376163323164363362
-62653861326434646537323365663534653462303239396333653132373337333262633934633439
-31316330373565313462613239626331383462613762303737386436646633363361373835643839
-38373863306534383831646162323839323433633139336636333037376633313939306438303635
-61356366613265333832326363626135663731316366633639343162383132373364396462623438
-39373630363439643762363464303233623631613030616135366332393163393835353064666362
-32663331323030356265366434356466613161323065366331343432656638646334316139656263
-62343331376335336434663636636436616338343837646566353131353661366165393565313062
-32326436396539623236316563306264396134613030623533343761623464323135396235303535
-38343662306636653039373962363030353666343837343865333965646538396432346264346236
-32616562336561633366656366396133346463613037366139656233313961393565373833643130
-63613434663330336431363732323132333166373762373831653362326466663862356534323331
-65653663323336613535383735303130336262343936356331363839643537623037633766626635
-62383837656532623734396438383334363466373439396435326163373531343963376131306461
-35323535356432633432393065346662336233393334396534346630393436303331666363653131
-65353932383566346366656161366136366564633036386262643333316533663962
+38663938363539353464613331616136616331306165376535336636653164613838643438376565
+3961346438313132643166396662333536326264353935390a626235663065666266383132626164
+35306337636461626533343438633766303464363065653432303438666234626436663235376263
+3337616265643730640a643265616330393136386139613166333834376336353532366362346662
+31363731616339336461306230616234323866373239313662643933653666626233616135333837
+38313935386234333165333230633236353261396337343936346161636435653663343139373839
+36303431623662363765373962333834386266303236623064356639633431313833663562633630
+36653962663763383334383862383337323132376536346335333235353364313965366332353164
+35306563616161626366653433333861616161623838343432663333643539303765323733643831
+33366166386661386562616634323730666534663937376164656365323163633034633435623734
+36393366653562363835633139316331636361373361363461656338363633373538333639343336
+62326365396666376239346265633463356664333263353639393562393137653666353439356330
+36643333383964393735666537336565373131396139363336613138326563653739626135363739
+32326663666634383736333933373939376366303036383466663361363235663862306331343231
+38323736336235633965643937646138646634323065373332346663343933643562363265633666
+30373234373066386132373361623833396330306364613138346461303132626236343334333664
+37653362383265623235306562366439353938653539663332313234353561303839353334636665
+66326434353265623831346562333863376161643862343430666438626231653033656464343162
+33303864303263386332396466616661343732616131363138343462303233616239636564343337
+31366561393137336533656437366331373130306131363138626130393435626236373830333232
+33633063656139316437386532353161363132656134623836626336663833366339363936313930
+63373930333438626430643261616565643537613133643230633663323334326234323664323533
+33613636626434323466663437336466636133313537356433313537306166663931343039623431
+32633932663731316435303933343534646439623232376463613463356637363635303263623333
+64623663643938363432623330333333306166633234346636666365653861303731333166363232
+34353733613263613630643331636634386539636637353163396634636438383166646563383461
+66356166633166656461613966306333666535393665323761323832313835613339363833666361
+39313536663962393734643237636162623832313261356435346661656536613461336431666431
+64353362343939343664313863363339636535653038343635393534393534393635343839333162
+63313136646563653636343534393366646563346537346662396538383535363566626365666264
+62393965303766376133383338396434376466663537333934333464333933636363396365393531
+33353437373962633938393331613339346662343964633931613735333864306261663139323662
+35633064356162336430343831343238333361346138303466646162393366663431623630646233
+61353466303363373162343534346132393539363033663062376539386334633066383635303961
+34306532316637333936633237343562653838656434316238656362633431633661646666346333
+64316163396137376266663033383032376431373062643832333764663766303461383933336231
+36346261343364376664323836333530613863363437373134633434373663383338616230303239
+32333362353133333164346462326333636539376239653638626163373166383834616462383136
+36393838616266356139303430313931396337306362663061346632383764326137303265373030
+31636466353139353135653765616561653463383737376461376532646162643434356263303764
+38663530666361656561633936643035616531313339623065343634633135383934343466313537
+61613465303761396239333835353735313235336463623265343064323032643832633133313831
+31396437383563633036363737376463316135366161653162613738633466633061343933343430
+37313433313934373266616634633065663030656163343032346462376265656363663262663064
+66396666636638393538373534323664636464386239643964666432396337666130323562303234
+39633431656333646538313762613661353764356532363833383136363335356530363761316366
+32346635333762656336643163616335363634346330613462393336656265303365643638396338
+32663933363738666465353931393937353336633337383166326634663966356336363566333232
+39373566393061643632313661356434663039623862343836376238323861363034643566343863
+31303936373236333865376131623462323130353163633031373839383962333237333564336666
+66316334303461336531366165626236616565373562633930323565616366616235313661303832
+61663436633435313933613436633138613135383066333735393563643466613237616161633234
+6462