feat: stuff

feat: basic routing to caddy
feat: added config edit to taskfile
2025-12-22 10:14:58 -05:00 · 2025-06-22 04:02:13 -04:00 · 2025-06-22 03:47:54 -04:00 · 2025-06-22 03:44:41 -04:00 · 2025-02-19 00:57:32 -05:00 · 2025-02-18 23:25:42 -05:00
25 changed files with 395 additions and 582 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -212,6 +212,4 @@ cython_debug/

 *secret*
 .vscode
-.DS_Store
-*.key
-*.out
+.DS_Store
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -1,13 +1,13 @@
 version: 3

 tasks:
-  vault: ansible-vault edit vault.yml {{.CLI_ARGS}}
-  provision: ansible-playbook playbooks/provision.yml {{.CLI_ARGS}}
-  deploy: ansible-playbook playbooks/deploy.yml {{.CLI_ARGS}}
-  restore: ansible-playbook playbooks/restore.yml {{.CLI_ARGS}}
+  dev:
+    - docker compose -f compose.dev.yml rm -fsv
+    - docker compose -f compose.dev.yml up --build --force-recreate --no-deps
+
+  deploy:fast: ansible-playbook playbooks/fast.yml
+  deploy:slow: ansible-playbook playbooks/slow.yml {{.CLI_ARGS}}
+  deploy:restore: ansible-playbook playbooks/restore.yml -e "restore_bucket={{.BUCKET}} restore_key={{.KEY}}"
  
-  enter:
-    cmd: ssh -i {{.KEY}} -p 2222 root@{{.IP}}
-    vars:
-      KEY: { sh: ansible-vault view vault.yml | yq -r ".secret.private_ssh_key_path" }
-      IP: { sh: cat dist/terraform_outputs.yml | jq -r ".server_ip.value" }
+  vault: ansible-vault edit vault.yml
+  inventory: ansible-vault edit inventory.ini
--- a/ansible.cfg
+++ b/ansible.cfg
@@ -1,8 +1,9 @@
 [defaults]
-callbacks_enabled = profile_tasks
 localhost_warning = False
-vault_password_file = vault.key
-interpreter_python = /usr/bin/python3.11
+inventory = inventory.ini
+host_key_checking = False
+interpreter_python = /usr/bin/python3
+vault_password_file = secret.key

 [inventory]
 inventory_unparsed_warning = False
@@ -10,4 +11,4 @@ inventory_unparsed_warning = False
 [ssh_connection]
 ssh_args = -o ControlMaster=auto -o ControlPersist=60s -o ForwardAgent=yes -o IdentityAgent=none
 pipelining = True
-retries = 2
+retries = 256
--- a/gitea/Dockerfile
+++ b/gitea/Dockerfile
@@ -4,4 +4,3 @@ ADD --chown=git:git config /etc/gitea
 ADD --chown=git:git custom /etc/gitea-custom

 ENV GITEA_CUSTOM=/etc/gitea-custom
-ENV BUCKET_KEY=""
--- a/gitea/Dockerfile.dev
+++ b/gitea/Dockerfile.dev
@@ -0,0 +1,13 @@
+FROM gitea/gitea:latest-rootless
+
+ADD --chown=git:git config /etc/gitea
+ADD --chown=git:git custom /etc/gitea-custom
+
+ENV GITEA_CUSTOM=/etc/gitea-custom
+
+RUN rm /etc/gitea/app.ini
+RUN mv /etc/gitea/dev.app.ini /etc/gitea/app.ini
+
+WORKDIR /etc/gitea-custom
+
+RUN gitea cert --host localhost --ca
--- a/gitea/config/app.ini
+++ b/gitea/config/app.ini
@@ -4,7 +4,7 @@ RUN_MODE = prod
 WORK_PATH = /var/lib/gitea

 [ui]
-DEFAULT_THEME = gitea-light
+DEFAULT_THEME = gitea-dark

 [repository]
 ROOT = /var/lib/gitea/git/repositories
@@ -24,12 +24,16 @@ DISABLE_SSH = false
 START_SSH_SERVER = true
 SSH_PORT = 22
 SSH_LISTEN_PORT = 22
+# SSH_DOMAIN = %(FULL_DOMAIN)s
 BUILTIN_SSH_SERVER_USER = git

 PROTOCOL=https
 ENABLE_ACME=true
 ACME_ACCEPTTOS=true
 ACME_DIRECTORY=https
+# ACME_EMAIL=%(EMAIL)s
+# DOMAIN = %(FULL_DOMAIN)s
+# ROOT_URL = %(ROOT_URL)s
 HTTP_PORT = 443

 [database]
@@ -93,5 +97,7 @@ DEFAULT_TRUST_MODEL = committer

 [storage]
 STORAGE_TYPE = minio
+MINIO_ENDPOINT = s3.us-east-1.amazonaws.com
+MINIO_BUCKET = myrica-faya
 MINIO_USE_SSL = true
-MINIO_INSECURE_SKIP_VERIFY = false
+MINIO_INSECURE_SKIP_VERIFY = false
--- a/gitea/config/dev.app.ini
+++ b/gitea/config/dev.app.ini
@@ -0,0 +1,106 @@
+APP_NAME = """Max's Code"""
+RUN_USER = git
+RUN_MODE = prod
+WORK_PATH = /var/lib/gitea
+
+[ui]
+DEFAULT_THEME = gitea-dark
+
+[repository]
+ROOT = /var/lib/gitea/git/repositories
+
+[repository.local]
+LOCAL_COPY_PATH = /tmp/gitea/local-repo
+
+[repository.upload]
+TEMP_PATH = /tmp/gitea/uploads
+
+[server]
+APP_DATA_PATH = /var/lib/gitea
+LFS_START_SERVER = true
+OFFLINE_MODE = true
+LFS_JWT_SECRET = x-----------------------------------------x
+
+DISABLE_SSH = false
+START_SSH_SERVER = true
+SSH_PORT = 2222
+SSH_LISTEN_PORT = 2222
+SSH_DOMAIN = localhost
+BUILTIN_SSH_SERVER_USER = git
+
+PROTOCOL  = https
+ROOT_URL  = https://localhost:443/
+DOMAIN = localhost
+HTTP_PORT = 443
+CERT_FILE = /etc/gitea-custom/cert.pem
+KEY_FILE  = /etc/gitea-custom/key.pem
+
+[database]
+DB_TYPE = sqlite3
+
+[session]
+PROVIDER_CONFIG = /var/lib/gitea/data/sessions
+PROVIDER = file
+
+[picture]
+AVATAR_UPLOAD_PATH = /var/lib/gitea/data/avatars
+REPOSITORY_AVATAR_UPLOAD_PATH = /var/lib/gitea/data/repo-avatars
+
+[attachment]
+PATH = /var/lib/gitea/data/attachments
+
+[log]
+ROOT_PATH = /var/lib/gitea/data/log
+MODE = console
+LEVEL = info
+
+[security]
+INSTALL_LOCK = true
+SECRET_KEY = 
+REVERSE_PROXY_LIMIT = 1
+REVERSE_PROXY_TRUSTED_PROXIES = *
+PASSWORD_HASH_ALGO = pbkdf2
+INTERNAL_TOKEN = x-----------------------------------------x
+
+[service]
+DISABLE_REGISTRATION = true
+REQUIRE_SIGNIN_VIEW = false
+REGISTER_EMAIL_CONFIRM = false
+ENABLE_NOTIFY_MAIL = false
+ALLOW_ONLY_EXTERNAL_REGISTRATION = false
+ENABLE_CAPTCHA = false
+DEFAULT_KEEP_EMAIL_PRIVATE = false
+DEFAULT_ALLOW_CREATE_ORGANIZATION = true
+DEFAULT_ENABLE_TIMETRACKING = true
+NO_REPLY_ADDRESS = noreply
+
+[lfs]
+PATH = /var/lib/gitea/git/lfs
+
+[mailer]
+ENABLED = false
+
+[openid]
+ENABLE_OPENID_SIGNIN = false
+ENABLE_OPENID_SIGNUP = false
+
+[cron.update_checker]
+ENABLED = false
+
+[repository.pull-request]
+DEFAULT_MERGE_STYLE = merge
+
+[repository.signing]
+DEFAULT_TRUST_MODEL = committer
+
+[oauth2]
+JWT_SECRET = x-----------------------------------------x
+
+[storage]
+STORAGE_TYPE = minio
+MINIO_ENDPOINT = localstack:4566
+MINIO_ACCESS_KEY_ID = test
+MINIO_SECRET_ACCESS_KEY = test
+MINIO_BUCKET = storage
+MINIO_USE_SSL = false
+MINIO_INSECURE_SKIP_VERIFY = true
--- a/inventory.ini
+++ b/inventory.ini
@@ -0,0 +1,26 @@
+$ANSIBLE_VAULT;1.1;AES256
+36326131353430646433363636333433313266666434623134633136373566306534323231373637
+6532386232643232343464393964623065326639643866640a353461626332623134613530663136
+35643737623066313565633035623161366631663630663664313736613063303333373634353064
+3333376338656539640a313561666239643466616161383561613833323765356238393034663865
+36643538346263653263646334343063326464656264633461363136383530393931393764356534
+38663963303737666632363239613836386235343730383530363536386165616339376435326639
+37333866323262336637383431323538393334393136623838343766636634316338633566343366
+32306461396134373161633437373730383933343865326363326435393232646163663461666437
+36613664633633306264656230363862306661363930376666616630363036396639643639343336
+65653162303435663166383934343936313935643936656235383930616539393239643634323237
+38613032323336333764633339396163306665666430333762343631383430613463666339323361
+63333964313832366532363334623236626232633132653639333231386663333865663665343530
+33613364386531633561373537353432643332663735663833663532373763383237316331306366
+64616462323739623833303661353764623537313432646137336230383830643761646131386263
+33663034303064373066363731653737363033373163386466663734643065613039336330313664
+37666332623264346132343638623332323661363338623335366230323737333961613035646366
+63316164316135633136326337363464373036383433333830646131363533363338383262623261
+63353737343236356561323738396631333133366338366538356232663834316230333265626562
+32363862396362376332383131316665383166386631336631656231636130323339623032386535
+38383339636339633961393632393063613261653061623465356238306330346464333039393134
+37356232626434646566346464636131396339646663383333393963336332313931656436353334
+36303039643837663130336362656636393737633962396531326231383862646631613061323737
+32346166396139383231663233356233646634633361346564356366343834313835343332363565
+66303933353231386331326462366239336361386638383861326662613732373661306330616334
+6634
--- a/playbooks/deploy.yml
+++ b/playbooks/deploy.yml
@@ -1,200 +0,0 @@
- name: Set up for fresh host.
-  gather_facts: false
-  hosts: localhost
-  vars_files:
-    - ../vault.yml
-    - ../dist/terraform_outputs.yml
-  tasks:
-    - name: Add remote host.
-      ansible.builtin.add_host:
-        name: server_fresh
-        ansible_ssh_host: "{{ server_ip.value }}"
-        ansible_user: root
-        ansible_port: 22
-        ansible_private_key_file: "{{ secret.private_ssh_key_path }}"
-
- name: Switch port to 2222.
-  hosts: server_fresh
-  ignore_unreachable: true
-  gather_facts: false
-  tasks:
-    - name: Update SSH port.
-      ansible.builtin.lineinfile:
-        dest: "/etc/ssh/sshd_config"
-        regexp: "^Port"
-        line: "Port 2222"
-
-    - name: Restart service.
-      ansible.builtin.service:
-        name: ssh
-        state: restarted
-
- name: Set up real host.
-  gather_facts: false
-  hosts: localhost
-  tags:
-    - deploy
-  vars_files:
-    - ../vault.yml
-    - ../dist/terraform_outputs.yml
-  tasks:
-    - name: Add remote host.
-      ansible.builtin.add_host:
-        name: server
-        ansible_ssh_host: "{{ server_ip.value }}"
-        ansible_user: root
-        ansible_port: 2222
-        ansible_private_key_file: "{{ secret.private_ssh_key_path }}"
-
- name: Install Docker.
-  gather_facts: true
-  hosts: server
-  vars_files:
-    - ../vault.yml
-    - ../dist/terraform_outputs.yml
-  tasks:
-    - name: Install PIP.
-      ansible.builtin.apt:
-        name:
-          - python3-pip
-        state: present
-
-    - name: Install needed packages.
-      ansible.builtin.pip:
-        name:
-          - botocore
-          - boto3
-          - packaging
-        state: present
-        break_system_packages: true
-
-    - name: Download Docker repository key.
-      ansible.builtin.apt_key:
-        url: https://download.docker.com/linux/debian/gpg
-        state: present
-
-    - name: Download Docker repository.
-      ansible.builtin.apt_repository:
-        repo: "deb https://download.docker.com/linux/debian {{ ansible_distribution_release }} stable"
-        state: present
-
-    - name: Remove bad packages.
-      ansible.builtin.apt:
-        state: absent
-        package:
-          - docker.io
-          - docker-doc
-          - docker-compose
-          - podman-docker
-          - containerd
-          - runc
-
-    - name: Download Docker dependencies.
-      ansible.builtin.apt:
-        state: present
-        package:
-          - ca-certificates
-          - curl
-
-    - name: Download Docker packages.
-      ansible.builtin.apt:
-        state: present
-        update_cache: true
-        package:
-          - docker-ce
-          - docker-ce-cli
-          - containerd.io
-          - docker-buildx-plugin
-          - docker-compose-plugin
-
- name: Deploy artifact to instance.
-  hosts: server
-  tags:
-    - deploy
-  gather_facts: false
-  vars_files:
-    - ../variables.yml
-    - ../vault.yml
-    - ../dist/terraform_outputs.yml
-  tasks:
-    - name: Copy gitea folder.
-      ansible.builtin.copy:
-        src: ../gitea/
-        dest: /root/gitea/
-        mode: preserve
-
-    - name: Build image.
-      community.docker.docker_image_build:
-        name: "{{ variables.image_name }}"
-        path: /root/gitea
-        nocache: true
-        rebuild: always
-        pull: true
-
-    - name: Create data directory.
-      ansible.builtin.file:
-        path: /root/data
-        state: directory
-        mode: '0777'
-
-    - name: Run image.
-      community.docker.docker_container:
-        name: server
-        image: "{{ variables.image_name }}"
-        state: started
-        recreate: true
-        restart_policy: unless-stopped
-        memory: 425m
-        memory_swap: 900m
-        ports: [80:80, 443:443, "22:22"]
-        env:
-          # Secrets.
-          GITEA__security__INTERNAL_TOKEN: "{{ secret.internal }}"
-          GITEA__server__LFS_JWT_SECRET: "{{ secret.lfs }}"
-          GITEA__oauth2__JWT_SECRET: "{{ secret.jwt }}"
-          GITEA__server__ACME_EMAIL: "acme@maximhutz.me"
-          GITEA__server__SSH_DOMAIN: "{{ server_fqdn.value }}"
-          GITEA__server__DOMAIN: "{{ server_fqdn.value }}"
-          GITEA__server__ROOT_URL: "https://{{ server_fqdn.value }}/"
-
-          # General S3 storage information.
-          GITEA__storage__MINIO_BUCKET: "{{ secret.bucket.name }}"
-          GITEA__storage__MINIO_ENDPOINT: "{{ secret.bucket.endpoint }}"
-          GITEA__storage__MINIO_ACCESS_KEY_ID: "{{ secret.bucket.access_key }}"
-          GITEA__storage__MINIO_SECRET_ACCESS_KEY: "{{ secret.bucket.secret_key }}"
-
-          # Set storage to specific S3 bucket path.
-          GITEA__storage_0x2E_attachments__MINIO_BASE_PATH: "{{ secret.storage.key }}/attachments"
-          GITEA__storage_0x2E_lfs__MINIO_BASE_PATH: "{{ secret.storage.key }}/lfs"
-          GITEA__storage_0x2E_avatars__MINIO_BASE_PATH: "{{ secret.storage.key }}/avatars"
-          GITEA__storage_0x2E_repo_0X2D_archive___MINIO_BASE_PATH: "{{ secret.storage.key }}/repo-archive"
-          GITEA__storage_0x2E_repo_0X2D_avatars__MINIO_BASE_PATH: "{{ secret.storage.key }}/repo-avatars"
-          GITEA__storage_0x2E_packages__MINIO_BASE_PATH: "{{ secret.storage.key }}/packages"
-          GITEA__storage_0x2E_actions_log__MINIO_BASE_PATH: "{{ secret.storage.key }}/actions_log"
-          GITEA__storage_0x2E_actions_artifacts__MINIO_BASE_PATH: "{{ secret.storage.key }}/actions_artifacts"
-
-        labels:
-          docker-volume-backup.stop-during-backup: "true"
-        volumes:
-          - /root/data:/var/lib/gitea
-          - /etc/timezone:/etc/timezone:ro
-          - /etc/localtime:/etc/localtime:ro
-
-    - name: Run backup.
-      community.docker.docker_container:
-        name: backup
-        image: offen/docker-volume-backup:v2
-        state: started
-        recreate: true
-        restart_policy: unless-stopped
-        volumes:
-          - /root/data:/backup/my-app-backup:ro
-          - /var/run/docker.sock:/var/run/docker.sock:ro
-        env:
-          AWS_S3_BUCKET_NAME: "{{ secret.bucket.name }}"
-          AWS_S3_PATH: "{{ secret.backup.key }}"
-          AWS_REGION: "{{ secret.bucket.region }}"
-          AWS_ACCESS_KEY_ID: "{{ secret.bucket.access_key }}"
-          AWS_SECRET_ACCESS_KEY: "{{ secret.bucket.secret_key }}"
-          AWS_ENDPOINT: "{{ secret.bucket.endpoint }}"
-          BACKUP_CRON_EXPRESSION: "0 0 * * *"
--- a/playbooks/fast.yml
+++ b/playbooks/fast.yml
@@ -0,0 +1,91 @@
+- name: Make build artifact.
+  hosts: localhost
+  vars_files:
+    - ../config/ansible.secret.json
+    - ../config/infrastructure.secret.json
+  gather_facts: false
+  tasks:
+    - name: Log into Docker.
+      community.docker.docker_login:
+        registry_url: '{{ full_domain.value }}'
+        username: '{{ username }}'
+        password: '{{ api_key }}'
+        reauthorize: true
+
+    - name: Build image.
+      community.docker.docker_image_build:
+        name: "{{ full_domain.value }}/{{ image_name }}:latest"
+        path: ../gitea
+        nocache: true
+        rebuild: always
+        pull: true
+        outputs: [{ type: image, push: true }]
+        platform:
+          - linux/amd64
+          - linux/arm64/v8
+
+    - name: Log out of Docker.
+      community.docker.docker_login:
+        state: absent
+
+- name: Deploy artifact to instance.
+  hosts: localhost
+  become: true
+  gather_facts: false
+  vars_files:
+    - ../config/ansible.secret.json
+    - ../config/infrastructure.secret.json
+  vars:
+    ansible_connection: aws_ssm
+    ansible_aws_ssm_plugin: "{{ ssm_plugin }}"
+    ansible_aws_ssm_bucket_name: "{{ image_bucket }}"
+    ansible_aws_ssm_instance_id: "{{ instance_id.value }}"
+    ansible_python_interpreter: /usr/bin/python3
+    ansible_aws_ssm_region: "{{ aws_region }}"
+    ansible_aws_ssm_access_key_id: "{{ aws_access_key }}"
+    ansible_aws_ssm_secret_access_key: "{{ aws_secret_key }}"
+  tasks:
+    - name: Run image.
+      community.docker.docker_container:
+        name: server
+        image: "{{ full_domain.value }}/{{ image_name }}:latest"
+        state: started
+        recreate: true
+        restart_policy: unless-stopped
+        memory: 425m
+        memory_swap: 900m
+        ports: [80:80, 2222:2222, 443:443, "22:22"]
+        env:
+          GITEA__security__INTERNAL_TOKEN: "{{ internal_secret }}"
+          GITEA__server__LFS_JWT_SECRET: "{{ lfs_secret }}"
+          GITEA__oauth2__JWT_SECRET: "{{ jwt_secret }}"
+          GITEA__server__ACME_EMAIL: "{{ email }}"
+          GITEA__server__SSH_DOMAIN: "{{ full_domain.value }}"
+          GITEA__server__DOMAIN: "{{ full_domain.value }}"
+          GITEA__server__ROOT_URL: "https://{{ full_domain.value }}/"
+          GITEA__storage__MINIO_ACCESS_KEY_ID: "{{ minio_access_key }}"
+          GITEA__storage__MINIO_SECRET_ACCESS_KEY: "{{ minio_secret_key }}"
+        labels:
+          docker-volume-backup.stop-during-backup: "true"
+        volumes:
+          - /home/ssm-user/data:/var/lib/gitea
+          - /etc/timezone:/etc/timezone:ro
+          - /etc/localtime:/etc/localtime:ro
+
+    - name: Run backup.
+      community.docker.docker_container:
+        name: backup
+        image: offen/docker-volume-backup:v2
+        state: started
+        recreate: true
+        restart_policy: unless-stopped
+        volumes:
+          - /home/ssm-user/data:/backup/my-app-backup:ro
+          - /var/run/docker.sock:/var/run/docker.sock:ro
+        env:
+          AWS_S3_BUCKET_NAME: "{{ boot_bucket }}"
+          AWS_S3_PATH: "{{ boot_key }}"
+          AWS_REGION: "{{ boot_region.value }}"
+          AWS_ACCESS_KEY_ID: "{{ boot_id.value }}"
+          AWS_SECRET_ACCESS_KEY: "{{ boot_secret.value }}"
+          BACKUP_CRON_EXPRESSION: "0 0 * * *"
--- a/playbooks/provision.yml
+++ b/playbooks/provision.yml
@@ -1,38 +0,0 @@
- name: Deploy terraform infrastructure.
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - ../vault.yml
-  tasks:
-    - name: Reconfigure and plan.
-      community.general.terraform:
-        project_path: '../terraform'
-        state: "planned"
-        plan_file: plan.out
-        # init_reconfigure: true
-        backend_config: "{{ terraform.backend }}"
-        variables: "{{ terraform.variables }}"
-        complex_vars: true
-
-    - name: Apply.
-      community.general.terraform:
-        project_path: '../terraform'
-        state: "present"
-        plan_file: plan.out
-        backend_config: "{{ terraform.backend }}"
-        variables: "{{ terraform.variables }}"
-        complex_vars: true
-      register: terraform_apply
-
-    - name: Create secret directory.
-      ansible.builtin.file:
-        path: ../dist
-        recurse: true
-        mode: "0755"
-        state: directory
-
-    - name: Send outputs to file.
-      ansible.builtin.copy:
-        content: "{{ terraform_apply.outputs }}"
-        dest: ../dist/terraform_outputs.yml
-        mode: '0755'
--- a/playbooks/restore.yml
+++ b/playbooks/restore.yml
@@ -1,25 +1,19 @@
- name: Set up real host.
-  gather_facts: false
-  hosts: localhost
-  vars_files:
-    - ../vault.yml
-    - ../dist/terraform_outputs.yml
-  tasks:
-    - name: Add remote host.
-      ansible.builtin.add_host:
-        name: server
-        ansible_ssh_host: "{{ server_ip.value }}"
-        ansible_user: root
-        ansible_port: 2222
-        ansible_private_key_file: "{{ secret.private_ssh_key_path }}"
-
 - name: Deploy artifact to instance.
-  hosts: server
+  hosts: localhost
  become: true
  gather_facts: false
  vars_files:
-    - ../vault.yml
-    - ../dist/terraform_outputs.yml
+    - ../config/ansible.secret.json
+    - ../config/infrastructure.secret.json
+  vars:
+    ansible_connection: aws_ssm
+    ansible_python_interpreter: /usr/bin/python3
+    ansible_aws_ssm_plugin: "{{ ssm_plugin }}"
+    ansible_aws_ssm_bucket_name: "{{ image_bucket }}"
+    ansible_aws_ssm_instance_id: "{{ instance_id.value }}"
+    ansible_aws_ssm_region: "{{ aws_region }}"
+    ansible_aws_ssm_access_key_id: "{{ aws_access_key }}"
+    ansible_aws_ssm_secret_access_key: "{{ aws_secret_key }}"
  tasks:
    - name: Stop server.
      community.docker.docker_container:
@@ -28,38 +22,38 @@
      loop: [server, backup]

    - name: Copy backup from S3.
+      environment:
+        region: "{{ boot_region.value }}"
+        access_key: "{{ boot_id.value }}"
+        secret_key: "{{ boot_secret.value }}"
      amazon.aws.s3_object:
-        bucket: "{{ secret.restore.bucket | mandatory(msg='You must specify the bucket of the data.') }}"
-        object: "{{ secret.restore.key | mandatory(msg='You must specify the key of the data.') }}"
-        dest: /root/snapshot.tar.gz
+        bucket: "{{ restore_bucket | mandatory(msg='You must specify the bucket of the data.') }}"
+        object: "{{ restore_key | mandatory(msg='You must specify the key of the data.') }}"
+        dest: /home/ssm-user/backup.tar.gz
        mode: get
-        region: "{{ secret.restore.region }}"
-        access_key: "{{ secret.restore.access_key }}"
-        secret_key: "{{ secret.restore.secret_key }}"
-        ignore_nonexistent_bucket: true

    - name: Ensure backup directory exists.
      ansible.builtin.file:
-        path: /root/restore
+        path: /home/ssm-user/backup
        state: directory
        mode: '0777'

    - name: Extract backup.
      ansible.builtin.unarchive:
-        src: /root/snapshot.tar.gz
-        dest: /root/restore
+        src: /home/ssm-user/backup.tar.gz
+        dest: /home/ssm-user/backup
        remote_src: true

    - name: Move backup files to data folder.
      ansible.builtin.copy:
        remote_src: true
-        src: /root/restore/backup/my-app-backup/
-        dest: /root/data/
+        src: /home/ssm-user/backup/backup/my-app-backup/
+        dest: /home/ssm-user/data/
        mode: '0777'

    - name: Update permissions.
      ansible.builtin.file:
-        path: /root/data
+        path: /home/ssm-user/data
        recurse: true
        mode: '0777'
        owner: 1000
--- a/playbooks/route.yml
+++ b/playbooks/route.yml
@@ -0,0 +1,19 @@
+- name: "Create route to instance."
+  hosts: router
+  gather_facts: false
+  tasks:
+    - name: Modify base Caddyfile.
+      ansible.builtin.blockinfile:
+        dest: ~/app/caddy/etc/Caddyfile
+        marker: '# GITEA {mark}'
+        content: "{{ lookup('file', '../router/Caddyfile') }}"
+      notify:
+        - Restart Caddy.
+
+  handlers:
+    - name: Restart Caddy.
+      ansible.builtin.systemd_service:
+        name: container-caddy
+        state: restarted
+        enabled: true
+        scope: user
--- a/playbooks/slow.yml
+++ b/playbooks/slow.yml
@@ -0,0 +1,84 @@
+- name: Make build artifact.
+  hosts: localhost
+  vars_files: ../config/ansible.secret.json
+  gather_facts: false
+  vars:
+    image_name: "service/gitea"
+  tasks:
+    - name: Build image.
+      community.docker.docker_image_build:
+        name: "{{ image_name }}"
+        path: ../gitea
+        nocache: true
+        rebuild: always
+        pull: true
+
+    - name: Create build directory.
+      ansible.builtin.file:
+        path: ../dist
+        state: directory
+        mode: '0777'
+
+    - name: Push image to archive.
+      community.docker.docker_image:
+        name: "{{ image_name }}"
+        archive_path: ../dist/image.tar
+        source: local
+
+    - name: Compress archive to artifact.
+      register: compress_image
+      community.general.archive:
+        path: ../dist/image.tar
+        dest: ../dist/image.tar.gz
+        format: gz
+        mode: "0644"
+
+- name: Deploy artifact to instance.
+  hosts: compute
+  gather_facts: false
+  tasks:
+    - name: Create data directory.
+      ansible.builtin.file:
+        path: "{{ item }}"
+        state: directory
+        mode: '0777'
+      loop:
+        - ~/app
+        - ~/app/gitea
+
+    - name: Pull image to remote.
+      ansible.posix.synchronize:
+        src: ../dist/image.tar.gz
+        dest: ~/app/gitea/image.tar.gz
+
+    - name: Load image.
+      containers.podman.podman_load:
+        path: ~/app/gitea/image.tar.gz
+      register: image
+
+    # - name: Run image.
+    #   community.docker.docker_container:
+    #     name: server
+    #     image: "{{ image.image_names[0] }}"
+    #     state: started
+    #     recreate: true
+    #     restart_policy: unless-stopped
+    #     memory: 425m
+    #     memory_swap: 900m
+    #     ports: [80:80, 2222:2222, 443:443, "22:22"]
+    #     env:
+    #       GITEA__security__INTERNAL_TOKEN: "{{ internal_secret }}"
+    #       GITEA__server__LFS_JWT_SECRET: "{{ lfs_secret }}"
+    #       GITEA__oauth2__JWT_SECRET: "{{ jwt_secret }}"
+    #       GITEA__server__ACME_EMAIL: "{{ email }}"
+    #       GITEA__server__SSH_DOMAIN: "{{ full_domain.value }}"
+    #       GITEA__server__DOMAIN: "{{ full_domain.value }}"
+    #       GITEA__server__ROOT_URL: "https://{{ full_domain.value }}/"
+    #       GITEA__storage__MINIO_ACCESS_KEY_ID: "{{ minio_access_key }}"
+    #       GITEA__storage__MINIO_SECRET_ACCESS_KEY: "{{ minio_secret_key }}"
+    #     labels:
+    #       docker-volume-backup.stop-during-backup: "true"
+    #     volumes:
+    #       - /home/ssm-user/data:/var/lib/gitea
+    #       - /etc/timezone:/etc/timezone:ro
+    #       - /etc/localtime:/etc/localtime:ro
--- a/requirements.txt
+++ b/requirements.txt
@@ -14,7 +14,6 @@ charset-normalizer==3.4.1
 click==8.1.8
 cryptography==44.0.0
 filelock==3.16.1
-go-task-bin==3.44.1
 idna==3.10
 importlib_metadata==8.5.0
 Jinja2==3.1.5
--- a/router/Caddyfile
+++ b/router/Caddyfile
@@ -0,0 +1,3 @@
+code.maximhutz.com {
+	respond "WIP!"
+}
--- a/terraform/.terraform.lock.hcl
+++ b/terraform/.terraform.lock.hcl
@@ -1,46 +0,0 @@
-# This file is maintained automatically by "terraform init".
-# Manual edits may be lost in future updates.
-
-provider "registry.terraform.io/hashicorp/aws" {
-  version = "6.12.0"
-  hashes = [
-    "h1:8u90EMle+I3Auh4f/LPP6fEfRsAF6xCFnUZF4b7ngEs=",
-    "zh:054bcbf13c6ac9ddd2247876f82f9b56493e2f71d8c88baeec142386a395165d",
-    "zh:195489f16ad5621db2cec80be997d33060462a3b8d442c890bef3eceba34fa4d",
-    "zh:3461ef14904ab7de246296e44d24c042f3190e6bead3d7ce1d9fda63dcb0f047",
-    "zh:44517a0035996431e4127f45db5a84f53ce80730eae35629eda3101709df1e5c",
-    "zh:4b0374abaa6b9a9debed563380cc944873e4f30771dd1da7b9e812a49bf485e3",
-    "zh:531468b99465bd98a89a4ce2f1a30168dfadf6edb57f7836df8a977a2c4f9804",
-    "zh:6a95ed7b4852174aa748d3412bff3d45e4d7420d12659f981c3d9f4a1a59a35f",
-    "zh:88c2d21af1e64eed4a13dbb85590c66a519f3ecc54b72875d4bb6326f3ef84e7",
-    "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
-    "zh:a8b648470bb5df098e56b1ec5c6a39e0bbb7b496b23a19ea9f494bf48d4a122a",
-    "zh:b23fb13efdb527677db546bc92aeb2bdf64ff3f480188841f2bfdfa7d3d907c1",
-    "zh:be5858a1951ae5f5a9c388949c3e3c66a3375f684fb79b06b1d1db7a9703b18e",
-    "zh:c368e03a7c922493daf4c7348faafc45f455225815ef218b5491c46cea5f76b7",
-    "zh:e31e75d5d19b8ac08aa01be7e78207966e1faa3b82ed9fe3acfdc2d806be924c",
-    "zh:ea84182343b5fd9252a6fae41e844eed4fdc3311473a753b09f06e49ec0e7853",
-  ]
-}
-
-provider "registry.terraform.io/hetznercloud/hcloud" {
-  version     = "1.52.0"
-  constraints = "~> 1.45"
-  hashes = [
-    "h1:LTjrLuC+4F1Kv4TxS9e7LVVkG8/S4QQ7X4ORblvKTbc=",
-    "zh:1e9bb6b6a2ea5f441638dbae2d60fbe04ff455f58a18c740b8b7913e2197d875",
-    "zh:29c122e404ba331cfbadacc7f1294de5a31c9dfd60bdfe3e1b402271fc8e419c",
-    "zh:2bd0ae2f0bb9f16b7753f59a08e57ac7230f9c471278d7882f81406b9426c8c7",
-    "zh:4383206971873f6b5d81580a9a36e0158924f5816ebb6206b0cf2430e4e6a609",
-    "zh:47e2ca1cfa18500e4952ab51dc357a0450d00a92da9ea03e452f1f3efe6bbf75",
-    "zh:8e9fe90e3cea29bb7892b64da737642fc22b0106402df76c228a3cbe99663278",
-    "zh:a2d69350a69c471ddb63bcc74e105e585319a0fc0f4d1b7f70569f6d2ece5824",
-    "zh:a97abcc254e21c294e2d6b0fc9068acfd63614b097dda365f1c56ea8b0fd5f6b",
-    "zh:aba8d72d4fe2e89c922d5446d329e5c23d00b28227b4666e6486ba18ea2ec278",
-    "zh:ad36c333978c2d9e4bc43dcadcbff42fe771a8c5ef53d028bcacec8287bf78a7",
-    "zh:cdb1e6903b9d2f0ad8845d4eb390fbe724ee2435fb045baeab38d4319e637682",
-    "zh:df77b08757f3f36b8aadb33d73362320174047044414325c56a87983f48b5186",
-    "zh:e07513d5ad387247092b5ae1c87e21a387fc51873b3f38eee616187e38b090a7",
-    "zh:e2be02bdc59343ff4b9e26c3b93db7680aaf3e6ed13c8c4c4b144c74c2689915",
-  ]
-}
--- a/terraform/install.sh
+++ b/terraform/install.sh
@@ -1,31 +0,0 @@
-#!/bin/sh
-
-## Install extras.
-rpm --rebuilddb
-amazon-linux-extras install docker ansible2 python3.8 -y
-
-# Make Docker work.
-systemctl enable docker
-systemctl start docker
-
-# Set up the correct version of Python (for Ansible).
-ln -sf /usr/bin/python3.8 /usr/bin/python3
-ln -sf /usr/bin/pip3.8 /usr/bin/pip3
-pip3 install botocore boto3 requests packaging --user ssm-user
-python3 -m pip install -U pip
-
-# Add some swap space.
-dd if=/dev/zero of=/swapfile bs=128M count=8
-chmod 600 /swapfile
-mkswap /swapfile
-swapon /swapfile
-
-# Stop SSH (because we have SSM.)
-service sshd stop
-
-# Install Docker Compose.
-curl -L "https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
-chmod +x /usr/local/bin/docker-compose
-
-# ERROR: SSM User not created yet.
-sudo usermod -aG docker ssm-user
--- a/terraform/main.tf
+++ b/terraform/main.tf
@@ -1,62 +0,0 @@
-resource "hcloud_primary_ip" "public_ip" {
-  name          = "repository-public-ip"
-  datacenter    = local.datacenter
-  type          = "ipv4"
-  assignee_type = "server"
-  auto_delete   = false
-}
-
-resource "hcloud_ssh_key" "ssh_key" {
-  name       = "repository-ssh-key"
-  public_key = file(var.public_ssh_key_path)
-}
-
-resource "hcloud_server" "server_instance" {
-  name        = "repository-server"
-  image       = local.server_image
-  server_type = local.server_type
-  datacenter  = local.datacenter
-  ssh_keys    = [hcloud_ssh_key.ssh_key.id]
-
-  public_net {
-    ipv4_enabled = true
-    ipv4         = hcloud_primary_ip.public_ip.id
-    ipv6_enabled = false
-  }
-}
-
-resource "hcloud_firewall" "server_firewall" {
-  name = "repository-server-firewall"
-
-  # Allow ICMP.
-  rule {
-    direction  = "in"
-    protocol   = "icmp"
-    source_ips = ["0.0.0.0/0", "::/0"]
-  }
-
-  # Allow all out.
-  rule {
-    direction       = "out"
-    protocol        = "tcp"
-    port            = "any"
-    destination_ips = ["0.0.0.0/0", "::/0"]
-  }
-
-  # Poke holes for applications, and SSH.
-  dynamic "rule" {
-    for_each = ["80", "443", "22", "2222"]
-
-    content {
-      direction  = "in"
-      protocol   = "tcp"
-      port       = rule.value
-      source_ips = ["0.0.0.0/0", "::/0"]
-    }
-  }
-}
-
-resource "hcloud_firewall_attachment" "server_fw_attachment" {
-  firewall_id = hcloud_firewall.server_firewall.id
-  server_ids  = [hcloud_server.server_instance.id]
-}
--- a/terraform/outputs.tf
+++ b/terraform/outputs.tf
@@ -1,11 +0,0 @@
-output "server_ip" {
-  description = "The public address of the server."
-  value = hcloud_server.server_instance.ipv4_address
-  sensitive = false
-}
-
-output "server_fqdn" {
-  description = "The public domain of the server."
-  value = "${local.subdomain}.${local.domain}"
-  sensitive = false
-}
--- a/terraform/providers.tf
+++ b/terraform/providers.tf
@@ -1,24 +0,0 @@
-terraform {
-  backend "s3" {
-    skip_credentials_validation = true
-    skip_region_validation = true
-    skip_requesting_account_id = true
-  }
-
-  required_providers {
-    hcloud = {
-      source  = "hetznercloud/hcloud"
-      version = "~> 1.45"
-    }
-  }
-}
-
-provider "hcloud" {
-  token = var.hcloud_token
-}
-
-provider "aws" {
-  region     = var.aws_region
-  access_key = var.aws_access_key
-  secret_key = var.aws_secret_key
-}
--- a/terraform/routing.tf
+++ b/terraform/routing.tf
@@ -1,13 +0,0 @@
-# The Route53 DNS zone.
-data "aws_route53_zone" "main" {
-  name = local.domain
-}
-
-# Push all domain traffic through the reverse proxy.
-resource "aws_route53_record" "domain" {
-  zone_id = data.aws_route53_zone.main.zone_id
-  name    = "${local.subdomain}.${data.aws_route53_zone.main.name}"
-  type    = "A"
-  ttl     = "60"
-  records = [hcloud_primary_ip.public_ip.ip_address]
-}
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -1,39 +0,0 @@
-locals {
-  datacenter = "fsn1-dc14"
-  server_type = "cx22"
-  server_image = "debian-12"
-
-  domain = "maximhutz.com"
-  subdomain = "git"
-}
-
-# ---------------------------------------------------------------------------- #
-
-variable "hcloud_token" {
-  sensitive = true
-  description = "The hCloud token used to access Hetzner resources."
-  type = string
-}
-
-variable "public_ssh_key_path" {
-  description = "The location of the public key used to access the repository server."
-  type = string
-}
-
-variable "aws_region" {
-  description = "The region of the AWS account."
-  type = string
-  sensitive = true
-}
-
-variable "aws_access_key" {
-  description = "The access key of the account."
-  type = string
-  sensitive = true
-}
-
-variable "aws_secret_key" {
-  description = "The secret key of the account."
-  type = string
-  sensitive = true
-}
--- a/variables.yml
+++ b/variables.yml
@@ -1,2 +0,0 @@
-variables:
-  image_name: mvhutz/gitea
--- a/vault.yml
+++ b/vault.yml
@@ -1,66 +1,6 @@
 $ANSIBLE_VAULT;1.1;AES256
-62366236383830323331383264663835316237363032333766333730653939666236666261653162
-3938653635393063313566343261303338666363386661650a376637613563303238373965356134
-30373861653832383462666231356163623231303637636539383166383039333562636434646334
-3433393163363562340a333962343636366234336239633032313166303163353165643762326464
-34353062323863666666666132663364633336623430373033623761613035666332323739313833
-38623639643539363639383339356231313431373437343430323237336539313939303139353534
-63616331353464613963323864626663396637313139646461356165643233306530303062666332
-36363636316335356434633439636434336666306466616231353135306538386334313937363765
-34333833626634383734396638646530393233623937396335313637333764313736383032333734
-64373966643030623331663139363034343536373830353338356335356338633638393862386230
-39336533656465366534306465396536613334333632643937316130303338626331386537343331
-64363966323561326262376631356261613231343335393233366231373631663635376234346164
-38303432386336643566363731386664376239666530336232666532616264353537353738636464
-64616364353730653831616335656532663336666339653337646133316661373038326164373235
-30653836336338333932303539393632326164623538303066353934623831376533333964346561
-61323137373837376161653730386637663336623130366639356130626338663764366661616163
-38356235386461366362396337646239633663303261616536386134663866333132613166373162
-33616663316566623665666464356135393932366663663932366235643336343434633731646665
-63323963366662346436393933643032653330313430633339613262306430306332326364343135
-37393764363338656639393333623835626135323434376338656663386662643339643135653938
-37396133373436353566646437633630373931643533383133343266626431393761646633666161
-66313365373537386332396562613531346634376266653631343934356134643463633566373162
-30633933636136663339316136333036386237346163646638393533336362363735623130623862
-38623666383461363564326462326239303838623533393034383831366631396530343037636532
-38366162396663653930633866303538353232656330643966386134316364313538646564313565
-61313732343330336436393963643164303139373036303437393336313738336138306438393364
-65623331663464626462316538663134346231643163356638383631623862313066343965376235
-65613736643163663238316532623638343062633564333865623264356362663433333734383365
-61373432656362343762333561376639396632386530353762303664373733656366343733613262
-62313562323938356563323939316131646239313432626261353431626661613235363566393038
-63656634383230316463363036306433366334643235656561613031653331333038323133653562
-61393034663030663432376331383236626639613663343662323639316331653432383036393130
-35376438333235336461313435316232373963613934323233613431643530646661666135613064
-34313431613164333761643965373939353864333234353136386637326536336266363733343332
-63393539353234343835633639333163386633326163623966343634346265623430326233353734
-61373339393264383038383564346462396362333132346632396534346134613038316231613966
-30636637626531343636376161326434336430386537646333353139353131363461613639646162
-31346538326138366663623439393764653237386564653666396338623435386639623239373438
-31616237343731623634643965386535663939356363653934343362633735353532353662396331
-39373639346336653739613162626537636663376163343831623762643765346535636565376463
-32366361373730376462356332363766376136613562613331386134633264613862383061343462
-38316637336437336637393030613933393633666332353533646362663661313930376337396234
-64636162343130326630366261356263363130663439393539363236343461343436316330663265
-32616665366664303038333966373835646130343237646464353362346132653331303634643165
-31393530373464653066643435343137313937326633653136623462363330343932383939626538
-61663137623931353166616639636635616232306161643432623563643633333739646336356236
-30663463303362396331396630623063646365373839333837333832643231396130636461636537
-35653937363434393331303065326137373931633231323861666632393762353162313635393830
-32666366376638383632666130353438316231313763323833663836663262646135633763376334
-64636531653937303136373063336430303536316636343835396532383164623539653966343865
-64316236656164653936613139643061323264333861623833383061386362333934373535633565
-37623065636437626165646261343265613234373963386134616632396433376162306432633038
-37356135663862363930303834303166333236643864383166333365313131333438373633653631
-35613639343638356135356537626231663661623364313837393065363031616661613032306462
-32653664373334636561613132336631613561363638666465393930336533333962383062316231
-35633535643836323131656337366139313864343632616266363666646130316532336465633562
-35326562633539386238613834656665306365643466356235326536383065623239653235653236
-34356636623263343932336266336664303362613537666630343935313362666466393134653262
-66396561363463646237363638336539663261626534363531636330386136623463366432313335
-36343236613863383139353461313562303534613166353866636262623866383736303262626438
-39353762303831353238323538626635393365363132646563626535613362326662653631663935
-35636134343266626162316135316533346331663634366630633437363531313732313161306665
-35336336323438613865396363363434663461646238346565336233363738666437323235336365
-37316561386137353338643561656262336336373736393939363039663731343636366435633162
-38383564663438303964643563613338306363623831613432333439386165303965
+66386561623561353461656662653566353665646466336635626561303031383735636666623063
+3336313938313562323336383765323932666638373232390a653163323131323564306438363864
+31333632326135353966656363633962616165623036373764646433353966616364376162636234
+3837333961383333640a383732346534346465353062653531353638663465306432396266663534
+3731
Author	SHA1	Message	Date
Max	b6b4978e68	feat: stuff	2025-12-22 10:14:58 -05:00
Max	b41d9f0e82	feat: basic routing to caddy	2025-06-22 04:02:13 -04:00
Max	06646e7ec7	feat: added config edit to taskfile	2025-06-22 03:47:54 -04:00
Max	80270b9a93	feat: created vaults, added to config	2025-06-22 03:44:41 -04:00
Max	2827653bd5	feat: works on production	2025-02-19 00:57:32 -05:00
Max	44e1d6d0e6	feat: S3 storage for development environmne	2025-02-18 23:25:42 -05:00