feat: deployment for runner

Adds better logo.

- Re-added back local development.

Reviewed-on: #3
Co-authored-by: M. V. Hutz <git@maximhutz.me>
Co-committed-by: M. V. Hutz <git@maximhutz.me>

.gitignore

@@ -37,7 +37,181 @@ override.tf.json
 .terraformrc
 terraform.rc
 
+# ---> Ansible
+*.retry
+
+# ---> Python
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#  Usually these files are written by a python script from a template
+#  before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py,cover
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+#Pipfile.lock
+
+# UV
+#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#uv.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+#poetry.lock
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+#pdm.lock
+#   pdm stores project-wide configurations in .pdm.toml, but it is recommended to not include it
+#   in version control.
+#   https://pdm.fming.dev/latest/usage/project/#working-with-version-control
+.pdm.toml
+.pdm-python
+.pdm-build/
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+#  JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#  be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#  and can be added to the global gitignore or merged into this file.  For a more nuclear
+#  option (not recommended) you can uncomment the following to ignore the entire idea folder.
+#.idea/
+
 *secret*
 .vscode
-.env
-.DS_Store
+.DS_Store
+*.key
+*.out

Taskfile.yml

@@ -1,25 +1,31 @@
 version: 3
-# silent: true
-
-includes:
-  tf: { taskfile: terraform, dir: terraform }
 
 tasks:
-  dev: docker compose -f compose.dev.yml up --build --force-recreate --no-deps
+  dev:
+    - docker compose down
+    - docker volume prune -f
+    - docker compose up --build --force-recreate
 
+  vault: ansible-vault edit vault.yml {{.CLI_ARGS}}
+  provision: ansible-playbook playbooks/provision.yml {{.CLI_ARGS}}
+  deploy:gitea: ansible-playbook playbooks/deploy.yml {{.CLI_ARGS}}
+  deploy:runner: ansible-playbook playbooks/runner.yml {{.CLI_ARGS}}
+  restore: ansible-playbook playbooks/restore.yml {{.CLI_ARGS}}
 
-  build:slow: ansible-playbook playbooks/build.yml
-  deploy:slow: ansible-playbook playbooks/deploy.yml
-  build:fast: ansible-playbook playbooks/fast-build.yml
-  deploy:fast: ansible-playbook playbooks/fast-deploy.yml
-  restore: ansible-playbook playbooks/restore.yml -e "restore_bucket={{.BUCKET}} restore_key={{.KEY}}"
-  run:slow: [task: build:slow, task: deploy:slow]
-  run:fast: [task: build:fast, task: deploy:fast]
-
-  enter:
-    cmd: aws ssm start-session --target $INSTANCE_ID
-    env:
-      INSTANCE_ID: { sh: jq -r .instance_id.value < config/infrastructure.secret.tf.json }
-      AWS_REGION: { sh: jq -r .aws_region < config/ansible.secret.json }
-      AWS_ACCESS_KEY_ID: { sh: jq -r .aws_access_key < config/ansible.secret.json }
-      AWS_SECRET_ACCESS_KEY: { sh: jq -r .aws_secret_key < config/ansible.secret.json }
+  assets:
+    - cp ./assets/icon.png ./gitea/custom/public/assets/img/logo.png
+    - cp ./assets/icon.svg ./gitea/custom/public/assets/img/logo.svg
+    - cp ./assets/logo.png ./gitea/custom/public/assets/img/favicon.png
+    - cp ./assets/logo.svg ./gitea/custom/public/assets/img/favicon.svg
+    - cp ./assets/logo.png ./gitea/custom/public/assets/img/apple-touch-icon.png
+  
+  enter:gitea:
+    cmd: ssh {{.GITEA}}
+    vars:
+      GITEA: { sh: cat ./variables.yml | yq -r ".variables.gitea_host" }
+  
+  enter:runner:
+    cmd: ssh -J {{.GITEA}} {{.RUNNER}}
+    vars:
+      GITEA: { sh: cat ./variables.yml | yq -r ".variables.gitea_host" }
+      RUNNER: { sh: cat ./variables.yml | yq -r ".variables.runner_host" }

ansible.cfg

@@ -1,6 +1,13 @@
 [defaults]
 callbacks_enabled = profile_tasks
 localhost_warning = False
+vault_password_file = vault.key
+interpreter_python = /usr/bin/python3.11
 
 [inventory]
 inventory_unparsed_warning = False
+
+[ssh_connection]
+ssh_args = -o ControlMaster=auto -o ControlPersist=60s -o ForwardAgent=yes -o IdentityAgent=none
+pipelining = True
+retries = 2

docker-compose.yml

@@ -5,6 +5,7 @@ services:
     container_name: web-git-instance
     depends_on:
       - backup
+      - bucket-script
     build:
       context: gitea
       dockerfile: Dockerfile.dev
@@ -31,7 +32,7 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock:ro
     environment:
       AWS_ENDPOINT: localstack:4566
-      AWS_S3_BUCKET_NAME: test
+      AWS_S3_BUCKET_NAME: backup
       AWS_ACCESS_KEY_ID: _
       AWS_SECRET_ACCESS_KEY: _
       BACKUP_CRON_EXPRESSION: "* * * * *"
@@ -59,7 +60,11 @@ services:
       AWS_ACCESS_KEY_ID: _
       AWS_SECRET_ACCESS_KEY: _
       AWS_ENDPOINT_URL: http://localstack:4566
-    command: '"aws s3api create-bucket --bucket test"'
+    command: |
+      "
+      aws s3api create-bucket --bucket backup
+      aws s3api create-bucket --bucket storage
+      "
 
 volumes:
   data:

gitea/Dockerfile

@@ -4,3 +4,4 @@ ADD --chown=git:git config /etc/gitea
 ADD --chown=git:git custom /etc/gitea-custom
 
 ENV GITEA_CUSTOM=/etc/gitea-custom
+ENV BUCKET_KEY=""

gitea/Dockerfile.dev

@@ -3,6 +3,8 @@ FROM gitea/gitea:latest-rootless
 ADD --chown=git:git config /etc/gitea
 ADD --chown=git:git custom /etc/gitea-custom
 
+ENV GITEA_CUSTOM=/etc/gitea-custom
+
 RUN rm /etc/gitea/app.ini
 RUN mv /etc/gitea/dev.app.ini /etc/gitea/app.ini
 

gitea/config/app.ini

@@ -4,7 +4,7 @@ RUN_MODE = prod
 WORK_PATH = /var/lib/gitea
 
 [ui]
-DEFAULT_THEME = gitea-dark
+DEFAULT_THEME = gitea-light
 
 [repository]
 ROOT = /var/lib/gitea/git/repositories
@@ -24,16 +24,12 @@ DISABLE_SSH = false
 START_SSH_SERVER = true
 SSH_PORT = 22
 SSH_LISTEN_PORT = 22
-# SSH_DOMAIN = %(FULL_DOMAIN)s
 BUILTIN_SSH_SERVER_USER = git
 
 PROTOCOL=https
 ENABLE_ACME=true
 ACME_ACCEPTTOS=true
 ACME_DIRECTORY=https
-# ACME_EMAIL=%(EMAIL)s
-# DOMAIN = %(FULL_DOMAIN)s
-# ROOT_URL = %(ROOT_URL)s
 HTTP_PORT = 443
 
 [database]
@@ -94,3 +90,8 @@ DEFAULT_MERGE_STYLE = merge
 
 [repository.signing]
 DEFAULT_TRUST_MODEL = committer
+
+[storage]
+STORAGE_TYPE = minio
+MINIO_USE_SSL = true
+MINIO_INSECURE_SKIP_VERIFY = false

gitea/config/dev.app.ini

@@ -4,7 +4,7 @@ RUN_MODE = prod
 WORK_PATH = /var/lib/gitea
 
 [ui]
-DEFAULT_THEME = gitea-dark
+DEFAULT_THEME = gitea-light
 
 [repository]
 ROOT = /var/lib/gitea/git/repositories
@@ -32,8 +32,8 @@ PROTOCOL  = https
 ROOT_URL  = https://localhost:443/
 DOMAIN = localhost
 HTTP_PORT = 443
-CERT_FILE = cert.pem
-KEY_FILE  = key.pem
+CERT_FILE = /etc/gitea-custom/cert.pem
+KEY_FILE  = /etc/gitea-custom/key.pem
 
 [database]
 DB_TYPE = sqlite3
@@ -95,3 +95,12 @@ DEFAULT_TRUST_MODEL = committer
 
 [oauth2]
 JWT_SECRET = x-----------------------------------------x
+
+[storage]
+STORAGE_TYPE = minio
+MINIO_ENDPOINT = localstack:4566
+MINIO_ACCESS_KEY_ID = test
+MINIO_SECRET_ACCESS_KEY = test
+MINIO_BUCKET = storage
+MINIO_USE_SSL = false
+MINIO_INSECURE_SKIP_VERIFY = true

gitea/custom/templates/home.tmpl

@@ -2,7 +2,7 @@
 <div role="main"
   aria-label="{{if .IsSigned}}{{ctx.Locale.Tr "dashboard"}}{{else}}{{ctx.Locale.Tr "home"}}{{end}}" class="page-content home">
   <div class="tw-mb-8 tw-px-8">
-    <div class="center">
+    <div class="center tw-gap-4">
       <img class="logo" width="220" height="220" src="{{AssetUrlPrefix}}/img/logo.svg" alt="{{ctx.Locale.Tr "logo"}}">
       <div class="hero">
         <h1 class="ui icon header title">{{AppName}}</h1>

playbooks/build.yml

@@ -1,42 +0,0 @@
-- name: Make build artifact.
-  hosts: localhost
-  vars_files: ../config/ansible.secret.json
-  gather_facts: false
-  tasks:
-    - name: Build image.
-      community.docker.docker_image_build:
-        name: "{{ image_name }}"
-        path: ../gitea
-        nocache: true
-        rebuild: always
-        pull: true
-
-    - name: Make temp file.
-      ansible.builtin.tempfile:
-        suffix: .tar
-      register: tar_file
-
-    - name: Push image to archive.
-      community.docker.docker_image:
-        name: "{{ image_name }}"
-        archive_path: "{{ tar_file.path }}"
-        source: local
-
-    - name: Compress archive to artifact.
-      register: compress_image
-      community.general.archive:
-        path: "{{ tar_file.path }}"
-        dest: "{{ tar_file.path }}.xz"
-        format: xz
-        mode: "0644"
-
-    - name: Push artifact to S3.
-      amazon.aws.s3_object:
-        bucket: "{{ image_bucket }}"
-        object: "{{ image_key }}"
-        src: "{{ tar_file.path }}.xz"
-        mode: put
-
-        region: "{{ aws_region }}"
-        access_key: "{{ aws_access_key }}"
-        secret_key: "{{ aws_secret_key }}"

playbooks/deploy.yml

@@ -1,65 +1,180 @@
-- name: Deploy artifact to instance.
+- name: Set up for fresh host.
+  gather_facts: false
   hosts: localhost
-  become: true
+  vars_files:
+    - ../vault.yml
+    - ../dist/terraform_outputs.yml
+  tasks:
+    - name: Add remote host.
+      ansible.builtin.add_host:
+        name: server_fresh
+        ansible_ssh_host: "{{ server_ip.value }}"
+        ansible_user: root
+        ansible_port: 22
+        ansible_private_key_file: "{{ secret.private_gitea_ssh_key_path }}"
+
+- name: Switch port to 2222.
+  hosts: server_fresh
+  ignore_unreachable: true
+  gather_facts: false
+  tasks:
+    - name: Update SSH port.
+      ansible.builtin.lineinfile:
+        dest: "/etc/ssh/sshd_config"
+        regexp: "^Port"
+        line: "Port 2222"
+
+    - name: Restart service.
+      ansible.builtin.service:
+        name: ssh
+        state: restarted
+
+- name: Set up real host.
+  gather_facts: false
+  hosts: localhost
+  tags:
+    - deploy
+  vars_files:
+    - ../vault.yml
+    - ../dist/terraform_outputs.yml
+  tasks:
+    - name: Add remote host.
+      ansible.builtin.add_host:
+        name: server
+        ansible_ssh_host: "{{ variables.gitea_host }}"
+
+- name: Install Docker.
+  gather_facts: true
+  hosts: server
+  vars_files:
+    - ../vault.yml
+    - ../dist/terraform_outputs.yml
+  tasks:
+    - name: Install PIP.
+      ansible.builtin.apt:
+        name:
+          - python3-pip
+        state: present
+        update_cache: true
+
+    - name: Install needed packages.
+      ansible.builtin.pip:
+        name:
+          - botocore
+          - boto3
+          - packaging
+        state: present
+        break_system_packages: true
+
+    - name: Download Docker repository key.
+      ansible.builtin.apt_key:
+        url: https://download.docker.com/linux/debian/gpg
+        state: present
+
+    - name: Download Docker repository.
+      ansible.builtin.apt_repository:
+        repo: "deb https://download.docker.com/linux/debian {{ ansible_distribution_release }} stable"
+        state: present
+
+    - name: Remove bad packages.
+      ansible.builtin.apt:
+        state: absent
+        package:
+          - docker.io
+          - docker-doc
+          - docker-compose
+          - podman-docker
+          - containerd
+          - runc
+
+    - name: Download Docker dependencies.
+      ansible.builtin.apt:
+        state: present
+        package:
+          - ca-certificates
+          - curl
+
+    - name: Download Docker packages.
+      ansible.builtin.apt:
+        state: present
+        update_cache: true
+        package:
+          - docker-ce
+          - docker-ce-cli
+          - containerd.io
+          - docker-buildx-plugin
+          - docker-compose-plugin
+
+- name: Deploy artifact to instance.
+  hosts: server
+  tags:
+    - deploy
   gather_facts: false
   vars_files:
-    - ../config/ansible.secret.json
-    - ../config/infrastructure.secret.tf.json
-  vars:
-    ansible_connection: aws_ssm
-    ansible_python_interpreter: /usr/bin/python3
-    ansible_aws_ssm_plugin: "{{ ssm_plugin }}"
-    ansible_aws_ssm_bucket_name: "{{ image_bucket }}"
-    ansible_aws_ssm_instance_id: "{{ instance_id.value }}"
-
-    ansible_aws_ssm_region: "{{ aws_region }}"
-    ansible_aws_ssm_access_key_id: "{{ aws_access_key }}"
-    ansible_aws_ssm_secret_access_key: "{{ aws_secret_key }}"
+    - ../variables.yml
+    - ../vault.yml
+    - ../dist/terraform_outputs.yml
   tasks:
-    - name: Fetch image.
-      amazon.aws.s3_object:
-        mode: get
-        bucket: "{{ image_bucket }}"
-        object: "{{ image_key }}"
-        dest: /root/image.tar.gz
+    - name: Copy gitea folder.
+      ansible.builtin.copy:
+        src: ../gitea/
+        dest: /root/gitea/
+        mode: preserve
 
-        region: "{{ aws_region }}"
-        access_key: "{{ aws_access_key }}"
-        secret_key: "{{ aws_secret_key }}"
+    - name: Build image.
+      community.docker.docker_image_build:
+        name: "{{ variables.image_name }}"
+        path: /root/gitea
+        nocache: true
+        rebuild: always
+        pull: true
 
     - name: Create data directory.
       ansible.builtin.file:
-        path: /home/ssm-user/data
+        path: /root/data
         state: directory
         mode: '0777'
 
-    - name: Load image.
-      community.docker.docker_image_load:
-        path: /root/image.tar.gz
-      register: image
-
     - name: Run image.
       community.docker.docker_container:
         name: server
-        image: "{{ image.image_names[0] }}"
+        image: "{{ variables.image_name }}"
         state: started
         recreate: true
         restart_policy: unless-stopped
         memory: 425m
         memory_swap: 900m
-        ports: [80:80, 2222:2222, 443:443, "22:22"]
+        ports: [80:80, 443:443, "22:22"]
         env:
-          GITEA__security__INTERNAL_TOKEN: "{{ internal_secret }}"
-          GITEA__server__LFS_JWT_SECRET: "{{ lfs_secret }}"
-          GITEA__oauth2__JWT_SECRET: "{{ jwt_secret }}"
-          GITEA__server__ACME_EMAIL: "{{ email }}"
-          GITEA__server__SSH_DOMAIN: "{{ full_domain.value }}"
-          GITEA__server__DOMAIN: "{{ full_domain.value }}"
-          GITEA__server__ROOT_URL: "https://{{ full_domain.value }}/"
+          # Secrets.
+          GITEA__security__INTERNAL_TOKEN: "{{ secret.internal }}"
+          GITEA__server__LFS_JWT_SECRET: "{{ secret.lfs }}"
+          GITEA__oauth2__JWT_SECRET: "{{ secret.jwt }}"
+          GITEA__server__ACME_EMAIL: "acme@maximhutz.me"
+          GITEA__server__SSH_DOMAIN: "{{ server_fqdn.value }}"
+          GITEA__server__DOMAIN: "{{ server_fqdn.value }}"
+          GITEA__server__ROOT_URL: "https://{{ server_fqdn.value }}/"
+
+          # General S3 storage information.
+          GITEA__storage__MINIO_BUCKET: "{{ secret.bucket.name }}"
+          GITEA__storage__MINIO_ENDPOINT: "{{ secret.bucket.endpoint }}"
+          GITEA__storage__MINIO_ACCESS_KEY_ID: "{{ secret.bucket.access_key }}"
+          GITEA__storage__MINIO_SECRET_ACCESS_KEY: "{{ secret.bucket.secret_key }}"
+
+          # Set storage to specific S3 bucket path.
+          GITEA__storage_0x2E_attachments__MINIO_BASE_PATH: "{{ secret.storage.key }}/attachments"
+          GITEA__storage_0x2E_lfs__MINIO_BASE_PATH: "{{ secret.storage.key }}/lfs"
+          GITEA__storage_0x2E_avatars__MINIO_BASE_PATH: "{{ secret.storage.key }}/avatars"
+          GITEA__storage_0x2E_repo_0X2D_archive___MINIO_BASE_PATH: "{{ secret.storage.key }}/repo-archive"
+          GITEA__storage_0x2E_repo_0X2D_avatars__MINIO_BASE_PATH: "{{ secret.storage.key }}/repo-avatars"
+          GITEA__storage_0x2E_packages__MINIO_BASE_PATH: "{{ secret.storage.key }}/packages"
+          GITEA__storage_0x2E_actions_log__MINIO_BASE_PATH: "{{ secret.storage.key }}/actions_log"
+          GITEA__storage_0x2E_actions_artifacts__MINIO_BASE_PATH: "{{ secret.storage.key }}/actions_artifacts"
+
         labels:
           docker-volume-backup.stop-during-backup: "true"
         volumes:
-          - /home/ssm-user/data:/var/lib/gitea
+          - /root/data:/var/lib/gitea
           - /etc/timezone:/etc/timezone:ro
           - /etc/localtime:/etc/localtime:ro
 
@@ -71,12 +186,13 @@
         recreate: true
         restart_policy: unless-stopped
         volumes:
-          - /home/ssm-user/data:/backup/my-app-backup:ro
+          - /root/data:/backup/my-app-backup:ro
           - /var/run/docker.sock:/var/run/docker.sock:ro
         env:
-          AWS_S3_BUCKET_NAME: "{{ boot_bucket }}"
-          AWS_S3_PATH: "{{ boot_key }}"
-          AWS_REGION: "{{ boot_region.value }}"
-          AWS_ACCESS_KEY_ID: "{{ boot_id.value }}"
-          AWS_SECRET_ACCESS_KEY: "{{ boot_secret.value }}"
+          AWS_S3_BUCKET_NAME: "{{ secret.bucket.name }}"
+          AWS_S3_PATH: "{{ secret.backup.key }}"
+          AWS_REGION: "{{ secret.bucket.region }}"
+          AWS_ACCESS_KEY_ID: "{{ secret.bucket.access_key }}"
+          AWS_SECRET_ACCESS_KEY: "{{ secret.bucket.secret_key }}"
+          AWS_ENDPOINT: "{{ secret.bucket.endpoint }}"
           BACKUP_CRON_EXPRESSION: "0 0 * * *"

playbooks/fast-build.yml

@@ -1,29 +0,0 @@
-- name: Make build artifact.
-  hosts: localhost
-  vars_files:
-    - ../config/ansible.secret.json
-    - ../config/infrastructure.secret.tf.json
-  gather_facts: false
-  tasks:
-    - name: Log into Docker.
-      community.docker.docker_login:
-        registry_url: '{{ full_domain.value }}'
-        username: '{{ username }}'
-        password: '{{ api_key }}'
-        reauthorize: true
-
-    - name: Build image.
-      community.docker.docker_image_build:
-        name: "{{ full_domain.value }}/{{ image_name }}:latest"
-        path: ../gitea
-        nocache: true
-        rebuild: always
-        pull: true
-        outputs: [{ type: image, push: true }]
-        platform:
-          - linux/amd64
-          - linux/arm64/v8
-
-    - name: Log out of Docker.
-      community.docker.docker_login:
-        state: absent

playbooks/fast-deploy.yml

@@ -1,60 +0,0 @@
-- name: Deploy artifact to instance.
-  hosts: localhost
-  become: true
-  gather_facts: false
-  vars_files:
-    - ../config/ansible.secret.json
-    - ../config/infrastructure.secret.tf.json
-  vars:
-    ansible_connection: aws_ssm
-    ansible_python_interpreter: /usr/bin/python3
-    ansible_aws_ssm_plugin: "{{ ssm_plugin }}"
-    ansible_aws_ssm_bucket_name: "{{ image_bucket }}"
-    ansible_aws_ssm_instance_id: "{{ instance_id.value }}"
-
-    ansible_aws_ssm_region: "{{ aws_region }}"
-    ansible_aws_ssm_access_key_id: "{{ aws_access_key }}"
-    ansible_aws_ssm_secret_access_key: "{{ aws_secret_key }}"
-  tasks:
-    - name: Run image.
-      community.docker.docker_container:
-        name: server
-        image: "{{ full_domain.value }}/{{ image_name }}:latest"
-        state: started
-        recreate: true
-        restart_policy: unless-stopped
-        memory: 425m
-        memory_swap: 900m
-        ports: [80:80, 2222:2222, 443:443, "22:22"]
-        env:
-          GITEA__security__INTERNAL_TOKEN: "{{ internal_secret }}"
-          GITEA__server__LFS_JWT_SECRET: "{{ lfs_secret }}"
-          GITEA__oauth2__JWT_SECRET: "{{ jwt_secret }}"
-          GITEA__server__ACME_EMAIL: "{{ email }}"
-          GITEA__server__SSH_DOMAIN: "{{ full_domain.value }}"
-          GITEA__server__DOMAIN: "{{ full_domain.value }}"
-          GITEA__server__ROOT_URL: "https://{{ full_domain.value }}/"
-        labels:
-          docker-volume-backup.stop-during-backup: "true"
-        volumes:
-          - /home/ssm-user/data:/var/lib/gitea
-          - /etc/timezone:/etc/timezone:ro
-          - /etc/localtime:/etc/localtime:ro
-
-    - name: Run backup.
-      community.docker.docker_container:
-        name: backup
-        image: offen/docker-volume-backup:v2
-        state: started
-        recreate: true
-        restart_policy: unless-stopped
-        volumes:
-          - /home/ssm-user/data:/backup/my-app-backup:ro
-          - /var/run/docker.sock:/var/run/docker.sock:ro
-        env:
-          AWS_S3_BUCKET_NAME: "{{ boot_bucket }}"
-          AWS_S3_PATH: "{{ boot_key }}"
-          AWS_REGION: "{{ boot_region.value }}"
-          AWS_ACCESS_KEY_ID: "{{ boot_id.value }}"
-          AWS_SECRET_ACCESS_KEY: "{{ boot_secret.value }}"
-          BACKUP_CRON_EXPRESSION: "0 0 * * *"

playbooks/provision.yml

@@ -0,0 +1,66 @@
+- name: Deploy terraform infrastructure.
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - ../vault.yml
+  tasks:
+    - name: Reconfigure and plan.
+      community.general.terraform:
+        project_path: '../terraform'
+        state: "planned"
+        plan_file: plan.out
+        # init_reconfigure: true
+        backend_config: "{{ terraform.backend }}"
+        variables: "{{ terraform.variables }}"
+        complex_vars: true
+
+    - name: Apply.
+      community.general.terraform:
+        project_path: '../terraform'
+        state: "present"
+        plan_file: plan.out
+        backend_config: "{{ terraform.backend }}"
+        variables: "{{ terraform.variables }}"
+        complex_vars: true
+      register: terraform_apply
+
+    - name: Create secret directory.
+      ansible.builtin.file:
+        path: ../dist
+        recurse: true
+        mode: "0755"
+        state: directory
+
+    - name: Send outputs to file.
+      ansible.builtin.copy:
+        content: "{{ terraform_apply.outputs }}"
+        dest: ../dist/terraform_outputs.yml
+        mode: '0755'
+
+- name: Update SSH config.
+  hosts: localhost
+  gather_facts: false
+  tags: hosts
+  vars_files:
+    - ../vault.yml
+    - ../dist/terraform_outputs.yml
+    - ../variables.yml
+  tasks:
+    - name: Add Gitea host.
+      community.general.ssh_config:
+        host: "{{ variables.gitea_host }}"
+        hostname: "{{ server_ip.value }}"
+        remote_user: root
+        forward_agent: true
+        user: user
+        port: 2222
+        identity_file: "{{ secret.private_gitea_ssh_key_path }}"
+
+    - name: Add Runner host.
+      community.general.ssh_config:
+        host: "{{ variables.runner_host }}"
+        remote_user: root
+        user: user
+        identity_file: "{{ secret.private_runner_ssh_key_path }}"
+        proxyjump: "{{ variables.gitea_host }}"
+        hostname: 10.0.10.17

playbooks/restore.yml

@@ -1,20 +1,22 @@
-- name: Deploy artifact to instance.
+- name: Set up real host.
+  gather_facts: false
   hosts: localhost
+  vars_files:
+    - ../vault.yml
+    - ../dist/terraform_outputs.yml
+  tasks:
+    - name: Add remote host.
+      ansible.builtin.add_host:
+        name: server
+        ansible_ssh_host: "{{ variables.gitea_host }}"
+
+- name: Deploy artifact to instance.
+  hosts: server
   become: true
   gather_facts: false
   vars_files:
-    - ../config/ansible.secret.json
-    - ../config/infrastructure.secret.tf.json
-  vars:
-    ansible_connection: aws_ssm
-    ansible_python_interpreter: /usr/bin/python3
-    ansible_aws_ssm_plugin: "{{ ssm_plugin }}"
-    ansible_aws_ssm_bucket_name: "{{ image_bucket }}"
-    ansible_aws_ssm_instance_id: "{{ instance_id.value }}"
-
-    ansible_aws_ssm_region: "{{ aws_region }}"
-    ansible_aws_ssm_access_key_id: "{{ aws_access_key }}"
-    ansible_aws_ssm_secret_access_key: "{{ aws_secret_key }}"
+    - ../vault.yml
+    - ../dist/terraform_outputs.yml
   tasks:
     - name: Stop server.
       community.docker.docker_container:
@@ -23,38 +25,39 @@
       loop: [server, backup]
 
     - name: Copy backup from S3.
-      environment:
-        region: "{{ boot_region.value }}"
-        access_key: "{{ boot_id.value }}"
-        secret_key: "{{ boot_secret.value }}"
       amazon.aws.s3_object:
-        bucket: "{{ restore_bucket | mandatory(msg='You must specify the bucket of the data.') }}"
-        object: "{{ restore_key | mandatory(msg='You must specify the key of the data.') }}"
-        dest: /home/ssm-user/backup.tar.gz
+        bucket: "{{ secret.restore.bucket | mandatory(msg='You must specify the bucket of the data.') }}"
+        object: "{{ secret.restore.key | mandatory(msg='You must specify the key of the data.') }}"
+        dest: /root/snapshot.tar.gz
         mode: get
+        endpoint_url: "{{ secret.restore.endpoint }}"
+        region: "{{ secret.restore.region }}"
+        access_key: "{{ secret.restore.access_key }}"
+        secret_key: "{{ secret.restore.secret_key }}"
+        ignore_nonexistent_bucket: true
 
     - name: Ensure backup directory exists.
       ansible.builtin.file:
-        path: /home/ssm-user/backup
+        path: /root/restore
         state: directory
         mode: '0777'
 
     - name: Extract backup.
       ansible.builtin.unarchive:
-        src: /home/ssm-user/backup.tar.gz
-        dest: /home/ssm-user/backup
+        src: /root/snapshot.tar.gz
+        dest: /root/restore
         remote_src: true
 
     - name: Move backup files to data folder.
       ansible.builtin.copy:
         remote_src: true
-        src: /home/ssm-user/backup/backup/my-app-backup/
-        dest: /home/ssm-user/data/
+        src: /root/restore/backup/my-app-backup/
+        dest: /root/data/
         mode: '0777'
 
     - name: Update permissions.
       ansible.builtin.file:
-        path: /home/ssm-user/data
+        path: /root/data
         recurse: true
         mode: '0777'
         owner: 1000

playbooks/runner.yml

@@ -0,0 +1,113 @@
+- name: Set up for fresh host.
+  gather_facts: false
+  hosts: localhost
+  vars_files:
+    - ../vault.yml
+    - ../variables.yml
+  tasks:
+    - name: Add runner host.
+      ansible.builtin.add_host:
+        name: runner
+        ansible_ssh_host: "{{ variables.runner_host }}"
+        ansible_ssh_extra_args: "-J {{ variables.gitea_host }}"
+
+    - name: Add Gitea host.
+      ansible.builtin.add_host:
+        name: gitea
+        ansible_ssh_host: "{{ variables.gitea_host }}"
+
+- name: Install Docker.
+  gather_facts: true
+  hosts: runner
+  vars_files:
+    - ../vault.yml
+    - ../dist/terraform_outputs.yml
+  tasks:
+    - name: Install PIP.
+      ansible.builtin.apt:
+        name:
+          - python3-pip
+        state: present
+        update_cache: true
+
+    - name: Install needed packages.
+      ansible.builtin.pip:
+        name:
+          - botocore
+          - boto3
+          - packaging
+        state: present
+        break_system_packages: true
+
+    - name: Download Docker repository key.
+      ansible.builtin.apt_key:
+        url: https://download.docker.com/linux/debian/gpg
+        state: present
+
+    - name: Download Docker repository.
+      ansible.builtin.apt_repository:
+        repo: "deb https://download.docker.com/linux/debian {{ ansible_distribution_release }} stable"
+        state: present
+
+    - name: Remove bad packages.
+      ansible.builtin.apt:
+        state: absent
+        package:
+          - docker.io
+          - docker-doc
+          - docker-compose
+          - podman-docker
+          - containerd
+          - runc
+
+    - name: Download Docker dependencies.
+      ansible.builtin.apt:
+        state: present
+        package:
+          - ca-certificates
+          - curl
+
+    - name: Download Docker packages.
+      ansible.builtin.apt:
+        state: present
+        update_cache: true
+        package:
+          - docker-ce
+          - docker-ce-cli
+          - containerd.io
+          - docker-buildx-plugin
+          - docker-compose-plugin
+
+- name: Get registration token for Runner.
+  hosts: gitea
+  gather_facts: false
+  tasks:
+    - name: Get registration token.
+      community.docker.docker_container_exec:
+        container: server
+        command: gitea actions grt
+      register: output
+
+    - name: Set fact.
+      ansible.builtin.set_fact:
+        registration_token: "{{ output.stdout }}"
+      delegate_to: localhost
+      delegate_facts: true
+
+- name: Deploy Runner.
+  hosts: runner
+  gather_facts: true
+  tasks:
+    - name: Deploy image.
+      community.docker.docker_container:
+        name: runner
+        image: docker.io/gitea/act_runner:nightly
+        env:
+          CONFIG_FILE: /config.yaml
+          GITEA_INSTANCE_URL: git.maximhutz.com
+          GITEA_RUNNER_REGISTRATION_TOKEN: "{{ hostvars['localhost']['registration_token'] }}"
+          GITEA_RUNNER_NAME: "Main Runner"
+        volumes:
+          - ./config.yaml:/config.yaml
+          - ./data:/data
+          - /var/run/docker.sock:/var/run/docker.sock

requirements.txt

@@ -3,6 +3,7 @@ ansible-compat==24.10.0
 ansible-core==2.18.1
 ansible-lint==24.12.2
 attrs==24.3.0
+awscli-local==0.22.0
 black==24.10.0
 boto3==1.35.95
 botocore==1.35.95
@@ -13,12 +14,14 @@ charset-normalizer==3.4.1
 click==8.1.8
 cryptography==44.0.0
 filelock==3.16.1
+go-task-bin==3.44.1
 idna==3.10
 importlib_metadata==8.5.0
 Jinja2==3.1.5
 jmespath==1.0.1
 jsonschema==4.23.0
 jsonschema-specifications==2024.10.1
+localstack-client==2.7
 MarkupSafe==3.0.2
 mypy-extensions==1.0.0
 packaging==24.2

terraform/.terraform.lock.hcl

@@ -2,23 +2,45 @@
 # Manual edits may be lost in future updates.
 
 provider "registry.terraform.io/hashicorp/aws" {
-  version = "5.83.1"
+  version = "6.12.0"
   hashes = [
-    "h1:Yy3K7R7881H72rQDzG6qjZVkrWA6DGJzfE21TionY7w=",
-    "zh:0313253c78f195973752c4d1f62bfdd345a9c99c1bc7a612a8c1f1e27d51e49e",
-    "zh:108523f3e9ebc93f7d900c51681f6edbd3f3a56b8a62b0afc31d8214892f91e0",
-    "zh:175b9bf2a00bea6ac1c73796ad77b0e00dcbbde166235017c49377d7763861d8",
-    "zh:1c8bf55b8548bbad683cd6d7bdb03e8840a00b2422dc1529ffb9892820657130",
-    "zh:22338f09bae62d5ff646de00182417f992548da534fee7d98c5d0136d4bd5d7a",
-    "zh:92de1107ec43de60612be5f6255616f16a9cf82d88df1af1c0471b81f3a82c16",
+    "h1:8u90EMle+I3Auh4f/LPP6fEfRsAF6xCFnUZF4b7ngEs=",
+    "zh:054bcbf13c6ac9ddd2247876f82f9b56493e2f71d8c88baeec142386a395165d",
+    "zh:195489f16ad5621db2cec80be997d33060462a3b8d442c890bef3eceba34fa4d",
+    "zh:3461ef14904ab7de246296e44d24c042f3190e6bead3d7ce1d9fda63dcb0f047",
+    "zh:44517a0035996431e4127f45db5a84f53ce80730eae35629eda3101709df1e5c",
+    "zh:4b0374abaa6b9a9debed563380cc944873e4f30771dd1da7b9e812a49bf485e3",
+    "zh:531468b99465bd98a89a4ce2f1a30168dfadf6edb57f7836df8a977a2c4f9804",
+    "zh:6a95ed7b4852174aa748d3412bff3d45e4d7420d12659f981c3d9f4a1a59a35f",
+    "zh:88c2d21af1e64eed4a13dbb85590c66a519f3ecc54b72875d4bb6326f3ef84e7",
     "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
-    "zh:9c7bfb7afea330e6d90e1466125a8cba3db1ed4043c5da52f737459c89290a6e",
-    "zh:ba59b374d477e5610674b70f5abfe0408e8f809390347372751384151440d3d0",
-    "zh:bd1c433966002f586d63cb1e3e16326991f238bc6beeb2352be36ec651917b0b",
-    "zh:ca2b4d1d02651c15261fffa4b142e45def9a22c6069353f0f663fd2046e268f8",
-    "zh:d8ed98c748f7a3f1a72277cfee9afe346aca39ab319d17402277852551d8f14a",
-    "zh:ed3d8bc89de5f35f3c5f4802ff7c749fda2e2be267f9af4a850694f099960a72",
-    "zh:f698732a4391c3f4d7079b4aaa52389da2a460cac5eed438ed688f147d603689",
-    "zh:f9f51b17f2978394954e9f6ab9ef293b8e11f1443117294ccf87f7f8212b3439",
+    "zh:a8b648470bb5df098e56b1ec5c6a39e0bbb7b496b23a19ea9f494bf48d4a122a",
+    "zh:b23fb13efdb527677db546bc92aeb2bdf64ff3f480188841f2bfdfa7d3d907c1",
+    "zh:be5858a1951ae5f5a9c388949c3e3c66a3375f684fb79b06b1d1db7a9703b18e",
+    "zh:c368e03a7c922493daf4c7348faafc45f455225815ef218b5491c46cea5f76b7",
+    "zh:e31e75d5d19b8ac08aa01be7e78207966e1faa3b82ed9fe3acfdc2d806be924c",
+    "zh:ea84182343b5fd9252a6fae41e844eed4fdc3311473a753b09f06e49ec0e7853",
+  ]
+}
+
+provider "registry.terraform.io/hetznercloud/hcloud" {
+  version     = "1.52.0"
+  constraints = "~> 1.45"
+  hashes = [
+    "h1:LTjrLuC+4F1Kv4TxS9e7LVVkG8/S4QQ7X4ORblvKTbc=",
+    "zh:1e9bb6b6a2ea5f441638dbae2d60fbe04ff455f58a18c740b8b7913e2197d875",
+    "zh:29c122e404ba331cfbadacc7f1294de5a31c9dfd60bdfe3e1b402271fc8e419c",
+    "zh:2bd0ae2f0bb9f16b7753f59a08e57ac7230f9c471278d7882f81406b9426c8c7",
+    "zh:4383206971873f6b5d81580a9a36e0158924f5816ebb6206b0cf2430e4e6a609",
+    "zh:47e2ca1cfa18500e4952ab51dc357a0450d00a92da9ea03e452f1f3efe6bbf75",
+    "zh:8e9fe90e3cea29bb7892b64da737642fc22b0106402df76c228a3cbe99663278",
+    "zh:a2d69350a69c471ddb63bcc74e105e585319a0fc0f4d1b7f70569f6d2ece5824",
+    "zh:a97abcc254e21c294e2d6b0fc9068acfd63614b097dda365f1c56ea8b0fd5f6b",
+    "zh:aba8d72d4fe2e89c922d5446d329e5c23d00b28227b4666e6486ba18ea2ec278",
+    "zh:ad36c333978c2d9e4bc43dcadcbff42fe771a8c5ef53d028bcacec8287bf78a7",
+    "zh:cdb1e6903b9d2f0ad8845d4eb390fbe724ee2435fb045baeab38d4319e637682",
+    "zh:df77b08757f3f36b8aadb33d73362320174047044414325c56a87983f48b5186",
+    "zh:e07513d5ad387247092b5ae1c87e21a387fc51873b3f38eee616187e38b090a7",
+    "zh:e2be02bdc59343ff4b9e26c3b93db7680aaf3e6ed13c8c4c4b144c74c2689915",
   ]
 }

terraform/Taskfile.yml

@@ -1,18 +0,0 @@
-version: 3
-silent: true
-
-vars:
-  BACKEND: ../config/backend.secret.tf.json
-  VARIABLES: ../config/variables.secret.tf.json
-  OUTPUT: ../config/infrastructure.secret.tf.json
-
-tasks:
-  init: terraform init -backend-config={{.BACKEND}}
-  plan: terraform plan -var-file={{.VARIABLES}}
-  destroy: terraform destroy
-  format: terraform fmt -recursive
-  out: terraform output -json > {{.OUTPUT}}
-  apply: 
-    - terraform apply -var-file={{.VARIABLES}}
-    - task: out
-  import: terraform import -var-file={{.VARIABLES}} {{.CLI_ARGS}}

terraform/iam.tf

@@ -1,31 +0,0 @@
-data "aws_s3_bucket" "storage_bucket" {
-  bucket = var.boot_bucket
-}
-
-data "aws_iam_policy_document" "boot" {
-  statement {
-    effect  = "Allow"
-    actions = ["s3:*", "s3-object-lambda:*"]
-    resources = [
-      "${data.aws_s3_bucket.storage_bucket.arn}/${var.boot_key}",
-      "${data.aws_s3_bucket.storage_bucket.arn}/${var.boot_key}/*",
-    ]
-  }
-}
-
-resource "aws_iam_policy" "boot" {
-  name        = "${var.boot_role}Policy"
-  description = "The policy that manages the Gitea Boot."
-
-  policy = data.aws_iam_policy_document.boot.json
-}
-
-module "boot_user" {
-  source  = "terraform-aws-modules/iam/aws//modules/iam-user"
-  version = "5.52.2"
-
-  create_iam_user_login_profile = false
-  name                          = "${var.boot_role}User"
-  password_reset_required       = false
-  policy_arns                   = [aws_iam_policy.boot.arn]
-}

terraform/install.sh

@@ -1,30 +0,0 @@
-#!/bin/sh
-
-rpm --rebuilddb
-amazon-linux-extras install docker ansible2 python3.8 -y
-
-# Make Docker work.
-systemctl enable docker
-systemctl start docker
-
-# Set up the correct version of Python (for Ansible).
-ln -sf /usr/bin/python3.8 /usr/bin/python3
-ln -sf /usr/bin/pip3.8 /usr/bin/pip3
-pip3 install botocore boto3 requests packaging
-python3 -m pip install -U pip
-
-# Add some swap space.
-dd if=/dev/zero of=/swapfile bs=128M count=8
-chmod 600 /swapfile
-mkswap /swapfile
-swapon /swapfile
-
-# Stop SSH (because we have SSM.)
-service sshd stop
-
-# Install Docker Compose.
-curl -L "https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
-chmod +x /usr/local/bin/docker-compose
-
-# ERROR: SSM User not created yet.
-sudo usermod -aG docker ssm-user

terraform/main.tf

@@ -1,41 +1,113 @@
-# An elastic IP, so if the reverse proxy is modified, the route tables won't.
-resource "aws_eip" "public" {
-  instance = aws_instance.this.id
-  domain   = "vpc"
+resource "hcloud_network" "network" {
+  name     = "network"
+  ip_range = "10.0.0.0/16"
 }
 
-data "aws_iam_instance_profile" "ssm" {
-  name = "SSMInstanceProfile"
+resource "hcloud_network_subnet" "subnet" {
+  type         = "cloud"
+  network_id   = hcloud_network.network.id
+  network_zone = "eu-central"
+  ip_range     = "10.0.10.0/24"
 }
 
-# The Gitea instance.
-resource "aws_instance" "this" {
-  # ami           = data.aws_ami.amazon-linux-2.id
-  ami           = "ami-0adec96dc0cdc7bca"
-  instance_type = "t4g.nano"
-  subnet_id     = module.vpc.public_subnets[0]
+/* -------------------------------------------------------------------------- */
 
-  user_data                   = file("install.sh")
-  user_data_replace_on_change = false
+resource "hcloud_primary_ip" "public_ip" {
+  name          = "repository-public-ip"
+  datacenter    = local.datacenter
+  type          = "ipv4"
+  assignee_type = "server"
+  auto_delete   = false
+}
 
-  iam_instance_profile   = data.aws_iam_instance_profile.ssm.name
-  vpc_security_group_ids = [aws_security_group.public_access.id]
-  
-  metadata_options {
-    http_tokens = "required"
+resource "hcloud_ssh_key" "gitea_ssh_key" {
+  name       = "repository-ssh-key"
+  public_key = file(var.public_gitea_ssh_key_path)
+}
+
+resource "hcloud_server" "gitea_server_instance" {
+  name        = "repository-gitea-server"
+  image       = local.server_image
+  server_type = local.server_type
+  datacenter  = local.datacenter
+  ssh_keys    = [hcloud_ssh_key.gitea_ssh_key.id]
+
+  public_net {
+    ipv4_enabled = true
+    ipv4         = hcloud_primary_ip.public_ip.id
+    ipv6_enabled = false
   }
 
-  root_block_device {
-    volume_type = "gp3"
-    volume_size = 8
+  network {
+    network_id = hcloud_network.network.id
+    ip = local.gitea_ip
+    alias_ips = [ ]
   }
 
-  tags = {
-    Name = "Codebase: Gitea"
+  depends_on = [ hcloud_network_subnet.subnet ]
+}
+
+resource "hcloud_firewall" "server_firewall" {
+  name = "repository-server-firewall"
+
+  # Allow ICMP.
+  rule {
+    direction  = "in"
+    protocol   = "icmp"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  # Allow all out.
+  rule {
+    direction       = "out"
+    protocol        = "tcp"
+    port            = "any"
+    destination_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  # Poke holes for applications, and SSH.
+  dynamic "rule" {
+    for_each = ["80", "443", "22", "2222"]
+
+    content {
+      direction  = "in"
+      protocol   = "tcp"
+      port       = rule.value
+      source_ips = ["0.0.0.0/0", "::/0"]
+    }
   }
 }
 
-resource "aws_ec2_instance_state" "this" {
-  instance_id = aws_instance.this.id
-  state       = "running"
+resource "hcloud_firewall_attachment" "server_fw_attachment" {
+  firewall_id = hcloud_firewall.server_firewall.id
+  server_ids  = [hcloud_server.gitea_server_instance.id]
 }
+
+/* -------------------------------------------------------------------------- */
+
+resource "hcloud_ssh_key" "runner_ssh_key" {
+  name       = "repository-runner-ssh-key"
+  public_key = file(var.public_runner_ssh_key_path)
+}
+
+resource "hcloud_server" "runner_instance" {
+  name        = "repository-runner-server"
+  image       = local.server_image
+  server_type = local.server_type
+  datacenter  = local.datacenter
+  ssh_keys    = [hcloud_ssh_key.runner_ssh_key.id]
+
+  network {
+    network_id = hcloud_network.network.id
+    ip = local.runner_ip
+    alias_ips = [ ]
+  }
+
+  public_net {
+    ipv4_enabled = false
+    ipv6_enabled = false
+  }
+
+  depends_on = [ hcloud_network_subnet.subnet ]
+}
+

terraform/network.tf

@@ -1,52 +0,0 @@
-locals {
-  # The IP block for the VPC.
-  vpc_cidr = "10.0.0.0/16"
-}
-
-data "aws_availability_zones" "all" {}
-
-# The main VPC.
-module "vpc" {
-  source = "terraform-aws-modules/vpc/aws"
-
-  name = "Main"
-  cidr = local.vpc_cidr
-
-  azs             = [data.aws_availability_zones.all.names[0]]
-  private_subnets = [cidrsubnet(local.vpc_cidr, 8, 0)]
-  public_subnets  = [cidrsubnet(local.vpc_cidr, 8, 4)]
-
-  private_subnet_tags = { SubnetOf = "Main", SubnetType = "Private" }
-  public_subnet_tags  = { SubnetOf = "Main", SubnetType = "Public" }
-
-  map_public_ip_on_launch = true
-  enable_dns_hostnames    = true
-  enable_dns_support      = true
-}
-
-# Only allow HTTP(s) and SSH traffic. Allow full access to internet.
-resource "aws_security_group" "public_access" {
-  vpc_id = module.vpc.vpc_id
-}
-
-resource "aws_vpc_security_group_ingress_rule" "ingress" {
-  for_each = toset(["80", "443", "22", "2222", "81", "8080", "4321", "1234"])
-
-  security_group_id = aws_security_group.public_access.id
-
-  from_port   = each.value
-  to_port     = each.value
-  ip_protocol = "tcp"
-  cidr_ipv4   = "0.0.0.0/0"
-}
-
-resource "aws_vpc_security_group_egress_rule" "egress" {
-  for_each = toset(["-1"])
-
-  security_group_id = aws_security_group.public_access.id
-
-  from_port   = each.value
-  to_port     = each.value
-  ip_protocol = "-1"
-  cidr_ipv4   = "0.0.0.0/0"
-}

terraform/output.tf

@@ -1,33 +0,0 @@
-output "instance_id" {
-  value       = aws_instance.this.id
-  description = "The instance ID of the Gitea instance."
-}
-
-output "ip_address" {
-  value       = aws_instance.this.private_ip
-  description = "The Gitea IP address."
-}
-
-output "boot_region" {
-  value       = var.aws_region
-  description = "The region to manipulate the codebase repository boot."
-  sensitive   = true
-}
-
-output "boot_id" {
-  value       = module.boot_user.iam_access_key_id
-  description = "The access id to manipulate the codebase repository boot."
-  sensitive   = true
-}
-
-output "boot_secret" {
-  value       = module.boot_user.iam_access_key_secret
-  description = "The access secret to manipulate the codebase repository boot."
-  sensitive   = true
-}
-
-output "full_domain" {
-  value       = "${var.subdomain}.${var.domain}"
-  description = "The domain of the Gitea instance."
-  sensitive   = true
-}

terraform/outputs.tf

@@ -0,0 +1,17 @@
+output "server_ip" {
+  description = "The public address of the server."
+  value = hcloud_server.gitea_server_instance.ipv4_address
+  sensitive = false
+}
+
+output "runner_ip" {
+  description = "The internal address of the CI runner."
+  value = local.runner_ip
+  sensitive = false
+}
+
+output "server_fqdn" {
+  description = "The public domain of the server."
+  value = "${local.subdomain}.${local.domain}"
+  sensitive = false
+}

terraform/providers.tf

@@ -1,11 +1,24 @@
 terraform {
-  # The backend is stored in an S3 bucket.
-  backend "s3" {}
+  backend "s3" {
+    skip_credentials_validation = true
+    skip_region_validation = true
+    skip_requesting_account_id = true
+  }
+
+  required_providers {
+    hcloud = {
+      source  = "hetznercloud/hcloud"
+      version = "~> 1.45"
+    }
+  }
+}
+
+provider "hcloud" {
+  token = var.hcloud_token
 }
 
-# Access AWS through the IaC roles.
 provider "aws" {
   region     = var.aws_region
-  access_key = var.aws_access
-  secret_key = var.aws_secret
+  access_key = var.aws_access_key
+  secret_key = var.aws_secret_key
 }

terraform/routing.tf

@@ -1,13 +1,13 @@
 # The Route53 DNS zone.
 data "aws_route53_zone" "main" {
-  name = var.domain
+  name = local.domain
 }
 
 # Push all domain traffic through the reverse proxy.
 resource "aws_route53_record" "domain" {
   zone_id = data.aws_route53_zone.main.zone_id
-  name    = "${var.subdomain}.${data.aws_route53_zone.main.name}"
+  name    = "${local.subdomain}.${data.aws_route53_zone.main.name}"
   type    = "A"
   ttl     = "60"
-  records = [aws_eip.public.public_ip]
+  records = [hcloud_primary_ip.public_ip.ip_address]
 }

terraform/variables.tf

@@ -1,39 +1,48 @@
+locals {
+  datacenter = "fsn1-dc14"
+  server_type = "cx22"
+  server_image = "debian-12"
+
+  domain = "maximhutz.com"
+  subdomain = "git"
+
+  network_cidr = "10.0.0.0/16"
+  gitea_ip = "10.0.10.16"
+  runner_ip = "10.0.10.17"
+}
+
+# ---------------------------------------------------------------------------- #
+
+variable "hcloud_token" {
+  sensitive = true
+  description = "The hCloud token used to access Hetzner resources."
+  type = string
+}
+
+variable "public_gitea_ssh_key_path" {
+  description = "The location of the public key used to access the repository Gitea server."
+  type = string
+}
+
+variable "public_runner_ssh_key_path" {
+  description = "The location of the public key used to access the repository Gitea Action runner."
+  type = string
+}
+
 variable "aws_region" {
-  type        = string
-  description = "The AWS region things are created in."
+  description = "The region of the AWS account."
+  type = string
+  sensitive = true
 }
 
-variable "aws_access" {
-  type        = string
-  description = "The access key to generate the Gitea instance."
+variable "aws_access_key" {
+  description = "The access key of the account."
+  type = string
+  sensitive = true
 }
 
-variable "aws_secret" {
-  type        = string
-  description = "The access secret to generate the Gitea instance."
-}
-
-variable "boot_bucket" {
-  type        = string
-  description = "The name of the bucket to store the boot in."
-}
-
-variable "boot_key" {
-  type        = string
-  description = "The path that will hold the boot data."
-}
-
-variable "boot_role" {
-  type        = string
-  description = "The name of the role for boot access."
-}
-
-variable "domain" {
-  type        = string
-  description = "The name of the domain."
-}
-
-variable "subdomain" {
-  type        = string
-  description = "The name of the subdomain."
-}
+variable "aws_secret_key" {
+  description = "The secret key of the account."
+  type = string
+  sensitive = true
+}

variables.yml

@@ -0,0 +1,4 @@
+variables:
+  image_name: mvhutz/gitea
+  gitea_host: repository_gitea
+  runner_host: repository_runner

vault.yml

@@ -0,0 +1,81 @@
+$ANSIBLE_VAULT;1.1;AES256
+34666138303266383336633235633037626261343833333763333463373261376165393735313230
+6133336466363137653966393733373236373161663434350a356634326634346530336632653535
+66386136393434616639626634376236656666656362346130343964356536393634616165303531
+6636396336303361320a353135303264313361373762303466383731313266666635316566383630
+33363332623266343834633962663837383433303034336661633235616565333837623064396137
+65373761343937666430336137656465643962336561346630626638343064306330323636366234
+38363035323061663266663466336638366236346162373338396538333637613834353235613061
+38313339353262643232613832623963376638643439666333333031356162303834363933313833
+35336332316337353936313963343636636464656639313930613133333866303933336635663737
+65663237663865313566666133666161626539376463363439313365333366323561653666616533
+61383334383230663330326236366262323464633432613562313239613031666261626334323666
+61616534343436356631383764383139386630656165376461313432643136653463306435353261
+65313363383339353434663139303961393865353230646138633161626235636437636135653763
+30313736366263303866313466333464303666396334643531343734623562636439616239663737
+32653536646234343435376365623466346131353262663261653438666137386662326332343263
+38343966373931326232393838613763653731383038373338353863303264366162373966613563
+36363137636236643663373837383161386266313963363437663835663037316230373466643466
+61353931653031313133393163353639373736636139366430653865663335303230306662393632
+30666435633434656434313736323732383135383638383334393433333530646661396232383635
+35363430313837373136643230386666623436383239336339623565356630303766333832306261
+63396565623164633466356437316233386561313932626262613162326332306638363130613533
+62363665363032646565643036636233323966373362663163373165323934383263316232323965
+39663733346637663735613434326239633337613933633765306261616363396465623565346136
+35336333363461653163343436633963343830306264333665393338363039636139343934353361
+39613664383134663766623165386266623661356230396535346166653761633831663566366339
+65353933663861333539336130633262303038633639333137313232363535636531353435303635
+39306433633261303634616533666230396566616131363435383662363432613634386266373966
+38323933303164323565326534326364646562316539643132616364646137323735373236633637
+36646337356333643766393464626633643263313437343932306634363532626563646163353661
+65636461663736663136366462346462633065313763666532303532366538386239383465323966
+36333465313338613635373336306266643862623262306237666235633532373163356630303163
+32353563623162303465376237313264646132656565313335653964323233636562613664316538
+32383737316362356365613064393662316434303932643136313866326235636632353135373735
+38656536623134623263656338356436656137313563353366666366643535393662356433376237
+30343961653363376162626333323261316635333366366131343136383362386131396466383662
+32393361383534636662663439363630663064383834363036396463383362666637646436326462
+36653734353036613139653462363563613635643166333262623533316330666166613239613136
+30366662333666653038303035323163323438323535366339646539323063373761346337373163
+63393833373663356635646236616564353936366437633766616333656538366263353664363031
+65303462623737323638326661326134303635353065323666616331323933646531376239626630
+35383232316666643166646232383837646262306331663337663961653861613536616632663764
+39326331373633336661346133316434623434306636643839306136363734353330663237366564
+32353237306633626564633034383466306239323833343838316638663065323834666438666135
+36643832646434633262393634333264333964383433643866356232613536396339353536346538
+62383832393033336133346435303463626165643463326538353864343565373830636635663237
+38653239393061353334326662633735643238333231663437343238613730383937363834623664
+37363661636230636632383331613264383064366238396163373838343062646432653462616635
+38313835333437653734336162326662346466633533623565376262653134373730356337623165
+62376464623438343165323037653631326565613737313062666232663130643638643165343466
+30636261343730366233643634643963363061346361663732663336393239623934313561626461
+33636365383863343138343964303630643463633732623462636465323464353063353134636430
+37653764396236386233313766393339323735623139633966336237363061326431636566376137
+30366636663235613136303462363035623135636461343638323266663661616335326332353034
+62333130373830613363396331613336616531313064356165613930373230383234363561346632
+64346635646338356430313536353436626265383561643166346561356430663238636561653363
+62386365363466663931333663373737646563363639356161613464373534643965653236356639
+63636237666332643966353131656435613933663230363665376333346563616634316430373235
+33643738326164656664643730376266666236333631393634356133633432373031613030663464
+61613964346133663638623038323161316665653436306533633438383563333465643731373537
+64333531653437373531306631363533643736326462343138323739356463383465626638626164
+62653862643032356264396461363530346633336230326166323563323830646464656633356430
+33323163626633303639613138343765626633323563303236396164376336396362306265363365
+38663237323533336263323636643536343963346337313938343262323366666130383339323337
+31396361316438333262656231356566363635343465383265633133343338376363303962343131
+34363537643731633735663635653163386264383334366134626230396439666439313963373934
+38373237383239336333656235613963623766343565653865623861353735366638356137313161
+63643735656463633063386239383961663230326665616233343634366531623561613732393131
+34623665333866343962306234623538306234653264373534633062363263653638303736666537
+32383832343939353438663738636537333834383934666536303233313763616434373663313737
+65313465313161656565376532386564646435373062313964633033616564393632623338666261
+62363034643363303337353565326438313832636165316363393238353531383837616337366530
+36663733376436336639633431313263373337313239303563313962663361653633356637616239
+64616665623563656137313537346238393432636235326164303165303136356264646634623438
+61633334303539616366653763383134643764323735333163353036373961353738386630643030
+61333861316565363536386465316637613065356235633335363834613733386130343132363130
+33663866656163386265303163613164303538333462343233343930346261663430383038343833
+34666439633562356633633666653338396131383531666238383962613737376531376638643265
+34313464313136356532313439616365386133653334383266383564333562663366386631656663
+37643837336138336237336462393937333437623665323063383464353662653865343433613164
+36346433653537656264