feat: stuff

.gitignore

@@ -212,6 +212,4 @@ cython_debug/
 
 *secret*
 .vscode
-.DS_Store
-*.key
-*.out
+.DS_Store

Taskfile.yml

@@ -2,34 +2,12 @@ version: 3
 
 tasks:
   dev:
-    - docker compose down
-    - docker volume prune -f
-    - docker compose up --build --force-recreate
+    - docker compose -f compose.dev.yml rm -fsv
+    - docker compose -f compose.dev.yml up --build --force-recreate --no-deps
 
-  vault: ansible-vault edit vault.yml {{.CLI_ARGS}}
-  provision: ansible-playbook playbooks/provision.yml {{.CLI_ARGS}}
-  deploy: ansible-playbook playbooks/deploy.yml {{.CLI_ARGS}}
-  destroy: ansible-playbook playbooks/destroy.yml {{.CLI_ARGS}}
-  restore: ansible-playbook playbooks/restore.yml {{.CLI_ARGS}}
-  runner: ansible-playbook playbooks/runner.yml {{.CLI_ARGS}}
-
-  assets:
-    - cp ./assets/icon.png ./gitea/custom/public/assets/img/logo.png
-    - cp ./assets/icon.svg ./gitea/custom/public/assets/img/logo.svg
-    - cp ./assets/logo.png ./gitea/custom/public/assets/img/favicon.png
-    - cp ./assets/logo.svg ./gitea/custom/public/assets/img/favicon.svg
-    - cp ./assets/logo.png ./gitea/custom/public/assets/img/apple-touch-icon.png
+  deploy:fast: ansible-playbook playbooks/fast.yml
+  deploy:slow: ansible-playbook playbooks/slow.yml {{.CLI_ARGS}}
+  deploy:restore: ansible-playbook playbooks/restore.yml -e "restore_bucket={{.BUCKET}} restore_key={{.KEY}}"
   
-  
-  enter:
-    cmd: ssh -i {{.KEY}} -p 2222 root@{{.IP}}
-    vars:
-      KEY: { sh: ansible-vault view vault.yml | yq -r ".secret.private_ssh_key_path" }
-      IP: { sh: cat dist/terraform_outputs.yml | jq -r ".server_ip.value" }
-
-  enter-runner:
-    cmd: ssh -i {{.KEY}} -o ProxyCommand="ssh -i {{.KEY}} -p 2222 -W %h:%p root@{{.IP}}" root@{{.RUNNER_IP}}
-    vars:
-      KEY: { sh: ansible-vault view vault.yml | yq -r ".secret.private_ssh_key_path" }
-      IP: { sh: cat dist/terraform_outputs.yml | jq -r ".server_ip.value" }
-      RUNNER_IP: { sh: cat dist/terraform_outputs.yml | jq -r ".runner_ip.value" }
+  vault: ansible-vault edit vault.yml
+  inventory: ansible-vault edit inventory.ini

ansible.cfg

@@ -1,10 +1,9 @@
 [defaults]
-callbacks_enabled = profile_tasks
 localhost_warning = False
-vault_password_file = vault.key
-interpreter_python = /usr/bin/python3.11
-editor = code --wait
-remote_tmp = /tmp/.ansible/tmp
+inventory = inventory.ini
+host_key_checking = False
+interpreter_python = /usr/bin/python3
+vault_password_file = secret.key
 
 [inventory]
 inventory_unparsed_warning = False
@@ -12,4 +11,4 @@ inventory_unparsed_warning = False
 [ssh_connection]
 ssh_args = -o ControlMaster=auto -o ControlPersist=60s -o ForwardAgent=yes -o IdentityAgent=none
 pipelining = True
-retries = 2
+retries = 256

compose.dev.yml

@@ -3,6 +3,7 @@ services:
   # Gitea itself.
   gitea:
     container_name: web-git-instance
+    restart: unless-stopped
     depends_on:
       - backup
       - bucket-script

gitea/Dockerfile

@@ -4,4 +4,3 @@ ADD --chown=git:git config /etc/gitea
 ADD --chown=git:git custom /etc/gitea-custom
 
 ENV GITEA_CUSTOM=/etc/gitea-custom
-ENV BUCKET_KEY=""

gitea/config/app.ini

@@ -4,7 +4,7 @@ RUN_MODE = prod
 WORK_PATH = /var/lib/gitea
 
 [ui]
-DEFAULT_THEME = gitea-light
+DEFAULT_THEME = gitea-dark
 
 [repository]
 ROOT = /var/lib/gitea/git/repositories
@@ -24,12 +24,16 @@ DISABLE_SSH = false
 START_SSH_SERVER = true
 SSH_PORT = 22
 SSH_LISTEN_PORT = 22
+# SSH_DOMAIN = %(FULL_DOMAIN)s
 BUILTIN_SSH_SERVER_USER = git
 
 PROTOCOL=https
 ENABLE_ACME=true
 ACME_ACCEPTTOS=true
 ACME_DIRECTORY=https
+# ACME_EMAIL=%(EMAIL)s
+# DOMAIN = %(FULL_DOMAIN)s
+# ROOT_URL = %(ROOT_URL)s
 HTTP_PORT = 443
 
 [database]
@@ -91,10 +95,9 @@ DEFAULT_MERGE_STYLE = merge
 [repository.signing]
 DEFAULT_TRUST_MODEL = committer
 
-[actions]
-ENABLED = true
-
 [storage]
 STORAGE_TYPE = minio
+MINIO_ENDPOINT = s3.us-east-1.amazonaws.com
+MINIO_BUCKET = myrica-faya
 MINIO_USE_SSL = true
-MINIO_INSECURE_SKIP_VERIFY = false
+MINIO_INSECURE_SKIP_VERIFY = false

gitea/config/dev.app.ini

@@ -4,7 +4,7 @@ RUN_MODE = prod
 WORK_PATH = /var/lib/gitea
 
 [ui]
-DEFAULT_THEME = gitea-light
+DEFAULT_THEME = gitea-dark
 
 [repository]
 ROOT = /var/lib/gitea/git/repositories
@@ -96,9 +96,6 @@ DEFAULT_TRUST_MODEL = committer
 [oauth2]
 JWT_SECRET = x-----------------------------------------x
 
-[actions]
-ENABLED = true
-
 [storage]
 STORAGE_TYPE = minio
 MINIO_ENDPOINT = localstack:4566

gitea/custom/templates/home.tmpl

@@ -2,7 +2,7 @@
 <div role="main"
   aria-label="{{if .IsSigned}}{{ctx.Locale.Tr "dashboard"}}{{else}}{{ctx.Locale.Tr "home"}}{{end}}" class="page-content home">
   <div class="tw-mb-8 tw-px-8">
-    <div class="center tw-gap-4">
+    <div class="center">
       <img class="logo" width="220" height="220" src="{{AssetUrlPrefix}}/img/logo.svg" alt="{{ctx.Locale.Tr "logo"}}">
       <div class="hero">
         <h1 class="ui icon header title">{{AppName}}</h1>

inventory.ini

@@ -0,0 +1,26 @@
+$ANSIBLE_VAULT;1.1;AES256
+36326131353430646433363636333433313266666434623134633136373566306534323231373637
+6532386232643232343464393964623065326639643866640a353461626332623134613530663136
+35643737623066313565633035623161366631663630663664313736613063303333373634353064
+3333376338656539640a313561666239643466616161383561613833323765356238393034663865
+36643538346263653263646334343063326464656264633461363136383530393931393764356534
+38663963303737666632363239613836386235343730383530363536386165616339376435326639
+37333866323262336637383431323538393334393136623838343766636634316338633566343366
+32306461396134373161633437373730383933343865326363326435393232646163663461666437
+36613664633633306264656230363862306661363930376666616630363036396639643639343336
+65653162303435663166383934343936313935643936656235383930616539393239643634323237
+38613032323336333764633339396163306665666430333762343631383430613463666339323361
+63333964313832366532363334623236626232633132653639333231386663333865663665343530
+33613364386531633561373537353432643332663735663833663532373763383237316331306366
+64616462323739623833303661353764623537313432646137336230383830643761646131386263
+33663034303064373066363731653737363033373163386466663734643065613039336330313664
+37666332623264346132343638623332323661363338623335366230323737333961613035646366
+63316164316135633136326337363464373036383433333830646131363533363338383262623261
+63353737343236356561323738396631333133366338366538356232663834316230333265626562
+32363862396362376332383131316665383166386631336631656231636130323339623032386535
+38383339636339633961393632393063613261653061623465356238306330346464333039393134
+37356232626434646566346464636131396339646663383333393963336332313931656436353334
+36303039643837663130336362656636393737633962396531326231383862646631613061323737
+32346166396139383231663233356233646634633361346564356366343834313835343332363565
+66303933353231386331326462366239336361386638383861326662613732373661306330616334
+6634

playbooks/deploy.yml

@@ -1,236 +0,0 @@
-- name: Set up for fresh host.
-  gather_facts: false
-  hosts: localhost
-  vars_files:
-    - ../vault.yml
-    - ../dist/terraform_outputs.yml
-  tasks:
-    - name: Add remote host.
-      ansible.builtin.add_host:
-        name: server_fresh
-        ansible_ssh_host: "{{ server_ip.value }}"
-        ansible_user: root
-        ansible_port: 22
-        ansible_private_key_file: "{{ secret.private_ssh_key_path }}"
-
-- name: Switch port to 2222.
-  hosts: server_fresh
-  ignore_unreachable: true
-  gather_facts: false
-  tasks:
-    - name: Update SSH port.
-      ansible.builtin.lineinfile:
-        dest: "/etc/ssh/sshd_config"
-        regexp: "^Port"
-        line: "Port 2222"
-
-    - name: Restart service.
-      ansible.builtin.service:
-        name: ssh
-        state: restarted
-
-- name: Set up real host.
-  gather_facts: false
-  hosts: localhost
-  tags:
-    - deploy
-  vars_files:
-    - ../vault.yml
-    - ../dist/terraform_outputs.yml
-  tasks:
-    - name: Add remote host.
-      ansible.builtin.add_host:
-        name: server
-        ansible_ssh_host: "{{ server_ip.value }}"
-        ansible_user: root
-        ansible_port: 2222
-        ansible_private_key_file: "{{ secret.private_ssh_key_path }}"
-
-- name: Install Docker.
-  gather_facts: true
-  hosts: server
-  vars_files:
-    - ../vault.yml
-    - ../dist/terraform_outputs.yml
-  tasks:
-    - name: Install PIP.
-      ansible.builtin.apt:
-        state: present
-        update_cache: true
-        name:
-          - python3-pip
-
-    - name: Install needed packages.
-      ansible.builtin.pip:
-        name:
-          - botocore
-          - boto3
-          - packaging
-        state: present
-        break_system_packages: true
-
-    - name: Download Docker repository key.
-      ansible.builtin.apt_key:
-        url: https://download.docker.com/linux/debian/gpg
-        state: present
-
-    - name: Download Docker repository.
-      ansible.builtin.apt_repository:
-        repo: "deb https://download.docker.com/linux/debian {{ ansible_distribution_release }} stable"
-        state: present
-
-    - name: Remove bad packages.
-      ansible.builtin.apt:
-        state: absent
-        package:
-          - docker.io
-          - docker-doc
-          - docker-compose
-          - podman-docker
-          - containerd
-          - runc
-
-    - name: Download Docker dependencies.
-      ansible.builtin.apt:
-        state: present
-        package:
-          - ca-certificates
-          - curl
-
-    - name: Download Docker packages.
-      ansible.builtin.apt:
-        state: present
-        update_cache: true
-        package:
-          - docker-ce
-          - docker-ce-cli
-          - containerd.io
-          - docker-buildx-plugin
-          - docker-compose-plugin
-
-- name: Enable NAT for private network.
-  hosts: server
-  gather_facts: false
-  tasks:
-    - name: Enable IP forwarding.
-      ansible.posix.sysctl:
-        name: net.ipv4.ip_forward
-        value: "1"
-        sysctl_set: true
-        reload: true
-
-    - name: Add NAT masquerade rule.
-      ansible.builtin.iptables:
-        table: nat
-        chain: POSTROUTING
-        source: "10.0.1.0/24"
-        jump: MASQUERADE
-        state: present
-
-    - name: Allow forwarding from private network.
-      ansible.builtin.iptables:
-        chain: DOCKER-USER
-        source: "10.0.1.0/24"
-        jump: ACCEPT
-        action: insert
-        state: present
-
-    - name: Allow established/related return traffic.
-      ansible.builtin.iptables:
-        chain: DOCKER-USER
-        ctstate: ESTABLISHED,RELATED
-        jump: ACCEPT
-        action: insert
-        state: present
-
-- name: Deploy artifact to instance.
-  hosts: server
-  tags:
-    - deploy
-  gather_facts: false
-  vars_files:
-    - ../variables.yml
-    - ../vault.yml
-    - ../dist/terraform_outputs.yml
-  tasks:
-    - name: Copy gitea folder.
-      ansible.builtin.copy:
-        src: ../gitea/
-        dest: /root/gitea/
-        mode: preserve
-
-    - name: Build image.
-      community.docker.docker_image_build:
-        name: "{{ variables.image_name }}"
-        path: /root/gitea
-        nocache: true
-        rebuild: always
-        pull: true
-
-    - name: Create data directory.
-      ansible.builtin.file:
-        path: /root/data
-        state: directory
-        mode: "0777"
-
-    - name: Run image.
-      community.docker.docker_container:
-        name: server
-        image: "{{ variables.image_name }}"
-        state: started
-        recreate: true
-        restart_policy: unless-stopped
-        memory: 425m
-        memory_swap: 900m
-        ports: [80:80, 443:443, "22:22"]
-        env:
-          # Secrets.
-          GITEA__security__INTERNAL_TOKEN: "{{ secret.internal }}"
-          GITEA__server__LFS_JWT_SECRET: "{{ secret.lfs }}"
-          GITEA__oauth2__JWT_SECRET: "{{ secret.jwt }}"
-          GITEA__server__ACME_EMAIL: "acme@maximhutz.me"
-          GITEA__server__SSH_DOMAIN: "{{ server_fqdn.value }}"
-          GITEA__server__DOMAIN: "{{ server_fqdn.value }}"
-          GITEA__server__ROOT_URL: "https://{{ server_fqdn.value }}/"
-
-          # General S3 storage information.
-          GITEA__storage__MINIO_BUCKET: "{{ secret.bucket.name }}"
-          GITEA__storage__MINIO_ENDPOINT: "{{ secret.bucket.endpoint }}"
-          GITEA__storage__MINIO_ACCESS_KEY_ID: "{{ secret.bucket.access_key }}"
-          GITEA__storage__MINIO_SECRET_ACCESS_KEY: "{{ secret.bucket.secret_key }}"
-
-          # Set storage to specific S3 bucket path.
-          GITEA__storage_0x2E_attachments__MINIO_BASE_PATH: "{{ secret.storage.key }}/attachments"
-          GITEA__storage_0x2E_lfs__MINIO_BASE_PATH: "{{ secret.storage.key }}/lfs"
-          GITEA__storage_0x2E_avatars__MINIO_BASE_PATH: "{{ secret.storage.key }}/avatars"
-          GITEA__storage_0x2E_repo_0X2D_archive___MINIO_BASE_PATH: "{{ secret.storage.key }}/repo-archive"
-          GITEA__storage_0x2E_repo_0X2D_avatars__MINIO_BASE_PATH: "{{ secret.storage.key }}/repo-avatars"
-          GITEA__storage_0x2E_packages__MINIO_BASE_PATH: "{{ secret.storage.key }}/packages"
-          GITEA__storage_0x2E_actions_log__MINIO_BASE_PATH: "{{ secret.storage.key }}/actions_log"
-          GITEA__storage_0x2E_actions_artifacts__MINIO_BASE_PATH: "{{ secret.storage.key }}/actions_artifacts"
-
-        labels:
-          docker-volume-backup.stop-during-backup: "true"
-        volumes:
-          - /root/data:/var/lib/gitea
-          - /etc/timezone:/etc/timezone:ro
-          - /etc/localtime:/etc/localtime:ro
-
-    - name: Run backup.
-      community.docker.docker_container:
-        name: backup
-        image: offen/docker-volume-backup:v2
-        state: started
-        recreate: true
-        restart_policy: unless-stopped
-        volumes:
-          - /root/data:/backup/my-app-backup:ro
-          - /var/run/docker.sock:/var/run/docker.sock:ro
-        env:
-          AWS_S3_BUCKET_NAME: "{{ secret.bucket.name }}"
-          AWS_S3_PATH: "{{ secret.backup.key }}"
-          AWS_REGION: "{{ secret.bucket.region }}"
-          AWS_ACCESS_KEY_ID: "{{ secret.bucket.access_key }}"
-          AWS_SECRET_ACCESS_KEY: "{{ secret.bucket.secret_key }}"
-          AWS_ENDPOINT: "{{ secret.bucket.endpoint }}"
-          BACKUP_CRON_EXPRESSION: "0 0 * * *"

playbooks/destroy.yml

@@ -1,15 +0,0 @@
-- name: Destroy terraform infrastructure.
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - ../vault.yml
-  tasks:
-    - name: Destroy Terraform.
-      community.general.terraform:
-        project_path: "../terraform"
-        state: "absent"
-        init_reconfigure: true
-        force_init: true
-        backend_config: "{{ terraform.backend }}"
-        variables: "{{ terraform.variables }}"
-        complex_vars: true

playbooks/fast.yml

@@ -0,0 +1,91 @@
+- name: Make build artifact.
+  hosts: localhost
+  vars_files:
+    - ../config/ansible.secret.json
+    - ../config/infrastructure.secret.json
+  gather_facts: false
+  tasks:
+    - name: Log into Docker.
+      community.docker.docker_login:
+        registry_url: '{{ full_domain.value }}'
+        username: '{{ username }}'
+        password: '{{ api_key }}'
+        reauthorize: true
+
+    - name: Build image.
+      community.docker.docker_image_build:
+        name: "{{ full_domain.value }}/{{ image_name }}:latest"
+        path: ../gitea
+        nocache: true
+        rebuild: always
+        pull: true
+        outputs: [{ type: image, push: true }]
+        platform:
+          - linux/amd64
+          - linux/arm64/v8
+
+    - name: Log out of Docker.
+      community.docker.docker_login:
+        state: absent
+
+- name: Deploy artifact to instance.
+  hosts: localhost
+  become: true
+  gather_facts: false
+  vars_files:
+    - ../config/ansible.secret.json
+    - ../config/infrastructure.secret.json
+  vars:
+    ansible_connection: aws_ssm
+    ansible_aws_ssm_plugin: "{{ ssm_plugin }}"
+    ansible_aws_ssm_bucket_name: "{{ image_bucket }}"
+    ansible_aws_ssm_instance_id: "{{ instance_id.value }}"
+    ansible_python_interpreter: /usr/bin/python3
+    ansible_aws_ssm_region: "{{ aws_region }}"
+    ansible_aws_ssm_access_key_id: "{{ aws_access_key }}"
+    ansible_aws_ssm_secret_access_key: "{{ aws_secret_key }}"
+  tasks:
+    - name: Run image.
+      community.docker.docker_container:
+        name: server
+        image: "{{ full_domain.value }}/{{ image_name }}:latest"
+        state: started
+        recreate: true
+        restart_policy: unless-stopped
+        memory: 425m
+        memory_swap: 900m
+        ports: [80:80, 2222:2222, 443:443, "22:22"]
+        env:
+          GITEA__security__INTERNAL_TOKEN: "{{ internal_secret }}"
+          GITEA__server__LFS_JWT_SECRET: "{{ lfs_secret }}"
+          GITEA__oauth2__JWT_SECRET: "{{ jwt_secret }}"
+          GITEA__server__ACME_EMAIL: "{{ email }}"
+          GITEA__server__SSH_DOMAIN: "{{ full_domain.value }}"
+          GITEA__server__DOMAIN: "{{ full_domain.value }}"
+          GITEA__server__ROOT_URL: "https://{{ full_domain.value }}/"
+          GITEA__storage__MINIO_ACCESS_KEY_ID: "{{ minio_access_key }}"
+          GITEA__storage__MINIO_SECRET_ACCESS_KEY: "{{ minio_secret_key }}"
+        labels:
+          docker-volume-backup.stop-during-backup: "true"
+        volumes:
+          - /home/ssm-user/data:/var/lib/gitea
+          - /etc/timezone:/etc/timezone:ro
+          - /etc/localtime:/etc/localtime:ro
+
+    - name: Run backup.
+      community.docker.docker_container:
+        name: backup
+        image: offen/docker-volume-backup:v2
+        state: started
+        recreate: true
+        restart_policy: unless-stopped
+        volumes:
+          - /home/ssm-user/data:/backup/my-app-backup:ro
+          - /var/run/docker.sock:/var/run/docker.sock:ro
+        env:
+          AWS_S3_BUCKET_NAME: "{{ boot_bucket }}"
+          AWS_S3_PATH: "{{ boot_key }}"
+          AWS_REGION: "{{ boot_region.value }}"
+          AWS_ACCESS_KEY_ID: "{{ boot_id.value }}"
+          AWS_SECRET_ACCESS_KEY: "{{ boot_secret.value }}"
+          BACKUP_CRON_EXPRESSION: "0 0 * * *"

playbooks/provision.yml

@@ -1,39 +0,0 @@
-- name: Deploy terraform infrastructure.
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - ../vault.yml
-  tasks:
-    - name: Reconfigure and plan.
-      community.general.terraform:
-        project_path: "../terraform"
-        state: "planned"
-        plan_file: plan.out
-        init_reconfigure: true
-        force_init: true
-        backend_config: "{{ terraform.backend }}"
-        variables: "{{ terraform.variables }}"
-        complex_vars: true
-
-    - name: Apply.
-      community.general.terraform:
-        project_path: "../terraform"
-        state: "present"
-        plan_file: plan.out
-        backend_config: "{{ terraform.backend }}"
-        variables: "{{ terraform.variables }}"
-        complex_vars: true
-      register: terraform_apply
-
-    - name: Create secret directory.
-      ansible.builtin.file:
-        path: ../dist
-        recurse: true
-        mode: "0755"
-        state: directory
-
-    - name: Send outputs to file.
-      ansible.builtin.copy:
-        content: "{{ terraform_apply.outputs }}"
-        dest: ../dist/terraform_outputs.yml
-        mode: "0755"

playbooks/restore.yml

@@ -1,25 +1,19 @@
-- name: Set up real host.
-  gather_facts: false
-  hosts: localhost
-  vars_files:
-    - ../vault.yml
-    - ../dist/terraform_outputs.yml
-  tasks:
-    - name: Add remote host.
-      ansible.builtin.add_host:
-        name: server
-        ansible_ssh_host: "{{ server_ip.value }}"
-        ansible_user: root
-        ansible_port: 2222
-        ansible_private_key_file: "{{ secret.private_ssh_key_path }}"
-
 - name: Deploy artifact to instance.
-  hosts: server
+  hosts: localhost
   become: true
   gather_facts: false
   vars_files:
-    - ../vault.yml
-    - ../dist/terraform_outputs.yml
+    - ../config/ansible.secret.json
+    - ../config/infrastructure.secret.json
+  vars:
+    ansible_connection: aws_ssm
+    ansible_python_interpreter: /usr/bin/python3
+    ansible_aws_ssm_plugin: "{{ ssm_plugin }}"
+    ansible_aws_ssm_bucket_name: "{{ image_bucket }}"
+    ansible_aws_ssm_instance_id: "{{ instance_id.value }}"
+    ansible_aws_ssm_region: "{{ aws_region }}"
+    ansible_aws_ssm_access_key_id: "{{ aws_access_key }}"
+    ansible_aws_ssm_secret_access_key: "{{ aws_secret_key }}"
   tasks:
     - name: Stop server.
       community.docker.docker_container:
@@ -28,41 +22,40 @@
       loop: [server, backup]
 
     - name: Copy backup from S3.
+      environment:
+        region: "{{ boot_region.value }}"
+        access_key: "{{ boot_id.value }}"
+        secret_key: "{{ boot_secret.value }}"
       amazon.aws.s3_object:
-        bucket: "{{ secret.restore.bucket | mandatory(msg='You must specify the bucket of the data.') }}"
-        object: "{{ secret.restore.key | mandatory(msg='You must specify the key of the data.') }}"
-        dest: /root/snapshot.tar.gz
+        bucket: "{{ restore_bucket | mandatory(msg='You must specify the bucket of the data.') }}"
+        object: "{{ restore_key | mandatory(msg='You must specify the key of the data.') }}"
+        dest: /home/ssm-user/backup.tar.gz
         mode: get
-        region: "{{ secret.restore.region }}"
-        access_key: "{{ secret.restore.access_key }}"
-        secret_key: "{{ secret.restore.secret_key }}"
-        endpoint_url: "{{ secret.restore.endpoint | mandatory(msg='You must specify the S3 URL.') }}"
-        ignore_nonexistent_bucket: true
 
     - name: Ensure backup directory exists.
       ansible.builtin.file:
-        path: /root/restore
+        path: /home/ssm-user/backup
         state: directory
-        mode: "0777"
+        mode: '0777'
 
     - name: Extract backup.
       ansible.builtin.unarchive:
-        src: /root/snapshot.tar.gz
-        dest: /root/restore
+        src: /home/ssm-user/backup.tar.gz
+        dest: /home/ssm-user/backup
         remote_src: true
 
     - name: Move backup files to data folder.
       ansible.builtin.copy:
         remote_src: true
-        src: /root/restore/backup/my-app-backup/
-        dest: /root/data/
-        mode: "0777"
+        src: /home/ssm-user/backup/backup/my-app-backup/
+        dest: /home/ssm-user/data/
+        mode: '0777'
 
     - name: Update permissions.
       ansible.builtin.file:
-        path: /root/data
+        path: /home/ssm-user/data
         recurse: true
-        mode: "0777"
+        mode: '0777'
         owner: 1000
         group: 1000
 

playbooks/route.yml

@@ -0,0 +1,19 @@
+- name: "Create route to instance."
+  hosts: router
+  gather_facts: false
+  tasks:
+    - name: Modify base Caddyfile.
+      ansible.builtin.blockinfile:
+        dest: ~/app/caddy/etc/Caddyfile
+        marker: '# GITEA {mark}'
+        content: "{{ lookup('file', '../router/Caddyfile') }}"
+      notify:
+        - Restart Caddy.
+
+  handlers:
+    - name: Restart Caddy.
+      ansible.builtin.systemd_service:
+        name: container-caddy
+        state: restarted
+        enabled: true
+        scope: user

playbooks/runner.yml

@@ -1,178 +0,0 @@
-- name: Set up runner host via jumphost.
-  gather_facts: false
-  hosts: localhost
-  vars_files:
-    - ../vault.yml
-    - ../dist/terraform_outputs.yml
-  tasks:
-    - name: Add gitea server as jumphost.
-      ansible.builtin.add_host:
-        name: server
-        ansible_ssh_host: "{{ server_ip.value }}"
-        ansible_user: root
-        ansible_port: 2222
-        ansible_private_key_file: "{{ secret.private_ssh_key_path }}"
-
-    - name: Add runner host (via jumphost).
-      ansible.builtin.add_host:
-        name: runner
-        ansible_ssh_host: "{{ runner_ip.value }}"
-        ansible_user: root
-        ansible_private_key_file: "{{ secret.private_ssh_key_path }}"
-        ansible_ssh_common_args: >-
-          -o ProxyCommand="ssh -i {{ secret.private_ssh_key_path }} -p 2222 -W %h:%p root@{{ server_ip.value }}"
-
-- name: Install Docker on runner.
-  gather_facts: true
-  hosts: runner
-  vars_files:
-    - ../vault.yml
-    - ../dist/terraform_outputs.yml
-  tasks:
-    - name: Set DNS resolver.
-      ansible.builtin.copy:
-        content: "nameserver 185.12.64.2\n"
-        dest: /etc/resolv.conf
-        mode: "0644"
-
-    - name: Install PIP.
-      ansible.builtin.apt:
-        state: present
-        update_cache: true
-        name:
-          - python3-pip
-
-    - name: Install needed packages.
-      ansible.builtin.pip:
-        name:
-          - packaging
-        state: present
-        break_system_packages: true
-
-    - name: Download Docker repository key.
-      ansible.builtin.apt_key:
-        url: https://download.docker.com/linux/debian/gpg
-        state: present
-
-    - name: Download Docker repository.
-      ansible.builtin.apt_repository:
-        repo: "deb https://download.docker.com/linux/debian {{ ansible_distribution_release }} stable"
-        state: present
-
-    - name: Remove bad packages.
-      ansible.builtin.apt:
-        state: absent
-        package:
-          - docker.io
-          - docker-doc
-          - docker-compose
-          - podman-docker
-          - containerd
-          - runc
-
-    - name: Download Docker dependencies.
-      ansible.builtin.apt:
-        state: present
-        package:
-          - ca-certificates
-          - curl
-          - jq
-
-    - name: Download Docker packages.
-      ansible.builtin.apt:
-        state: present
-        update_cache: true
-        package:
-          - docker-ce
-          - docker-ce-cli
-          - containerd.io
-          - docker-buildx-plugin
-          - docker-compose-plugin
-
-- name: Configure swap on runner.
-  hosts: runner
-  gather_facts: false
-  tasks:
-    - name: Create swapfile.
-      ansible.builtin.command:
-        cmd: fallocate -l 2G /swapfile
-        creates: /swapfile
-
-    - name: Set swapfile permissions.
-      ansible.builtin.file:
-        path: /swapfile
-        mode: "0600"
-
-    - name: Check if swap is active.
-      ansible.builtin.command:
-        cmd: swapon --show=NAME --noheadings
-      register: swap_status
-      changed_when: false
-
-    - name: Format swapfile.
-      ansible.builtin.command:
-        cmd: mkswap /swapfile
-      when: "'/swapfile' not in swap_status.stdout"
-      changed_when: true
-
-    - name: Enable swapfile.
-      ansible.builtin.command:
-        cmd: swapon /swapfile
-      when: "'/swapfile' not in swap_status.stdout"
-      changed_when: true
-
-    - name: Add swapfile to fstab.
-      ansible.posix.mount:
-        path: none
-        src: /swapfile
-        fstype: swap
-        opts: sw
-        state: present
-
-- name: Register and start Gitea runner.
-  hosts: runner
-  gather_facts: false
-  vars_files:
-    - ../vault.yml
-    - ../dist/terraform_outputs.yml
-  vars:
-    gitea_hostname: "{{ server_fqdn.value }}"
-    gitea_internal_url: "https://{{ gitea_hostname }}"
-  tasks:
-    - name: Create runner data volume.
-      community.docker.docker_volume:
-        name: runner-data
-        state: present
-
-    - name: Generate runner config.
-      ansible.builtin.copy:
-        dest: /root/runner-config.yaml
-        mode: "0644"
-        content: |
-          runner:
-            insecure: true
-            capacity: 1
-          cache:
-            enabled: false
-          container:
-            options: "--add-host {{ gitea_hostname }}:10.0.1.2 --memory=1536m"
-            valid_volumes:
-              - /var/run/docker.sock
-
-    - name: Start Gitea runner container.
-      community.docker.docker_container:
-        name: gitea-runner
-        image: gitea/act_runner:latest
-        state: started
-        recreate: true
-        restart_policy: unless-stopped
-        etc_hosts: "{{ {gitea_hostname: '10.0.1.2'} }}"
-        volumes:
-          - runner-data:/data
-          - /var/run/docker.sock:/var/run/docker.sock
-          - /root/runner-config.yaml:/config.yaml:ro
-        env:
-          GITEA_INSTANCE_URL: "{{ gitea_internal_url }}"
-          GITEA_RUNNER_REGISTRATION_TOKEN: "{{ secret.runner_registration_token }}"
-          GITEA_RUNNER_NAME: "runner-01"
-          CONFIG_FILE: "/config.yaml"

playbooks/slow.yml

@@ -0,0 +1,84 @@
+- name: Make build artifact.
+  hosts: localhost
+  vars_files: ../config/ansible.secret.json
+  gather_facts: false
+  vars:
+    image_name: "service/gitea"
+  tasks:
+    - name: Build image.
+      community.docker.docker_image_build:
+        name: "{{ image_name }}"
+        path: ../gitea
+        nocache: true
+        rebuild: always
+        pull: true
+
+    - name: Create build directory.
+      ansible.builtin.file:
+        path: ../dist
+        state: directory
+        mode: '0777'
+
+    - name: Push image to archive.
+      community.docker.docker_image:
+        name: "{{ image_name }}"
+        archive_path: ../dist/image.tar
+        source: local
+
+    - name: Compress archive to artifact.
+      register: compress_image
+      community.general.archive:
+        path: ../dist/image.tar
+        dest: ../dist/image.tar.gz
+        format: gz
+        mode: "0644"
+
+- name: Deploy artifact to instance.
+  hosts: compute
+  gather_facts: false
+  tasks:
+    - name: Create data directory.
+      ansible.builtin.file:
+        path: "{{ item }}"
+        state: directory
+        mode: '0777'
+      loop:
+        - ~/app
+        - ~/app/gitea
+
+    - name: Pull image to remote.
+      ansible.posix.synchronize:
+        src: ../dist/image.tar.gz
+        dest: ~/app/gitea/image.tar.gz
+
+    - name: Load image.
+      containers.podman.podman_load:
+        path: ~/app/gitea/image.tar.gz
+      register: image
+
+    # - name: Run image.
+    #   community.docker.docker_container:
+    #     name: server
+    #     image: "{{ image.image_names[0] }}"
+    #     state: started
+    #     recreate: true
+    #     restart_policy: unless-stopped
+    #     memory: 425m
+    #     memory_swap: 900m
+    #     ports: [80:80, 2222:2222, 443:443, "22:22"]
+    #     env:
+    #       GITEA__security__INTERNAL_TOKEN: "{{ internal_secret }}"
+    #       GITEA__server__LFS_JWT_SECRET: "{{ lfs_secret }}"
+    #       GITEA__oauth2__JWT_SECRET: "{{ jwt_secret }}"
+    #       GITEA__server__ACME_EMAIL: "{{ email }}"
+    #       GITEA__server__SSH_DOMAIN: "{{ full_domain.value }}"
+    #       GITEA__server__DOMAIN: "{{ full_domain.value }}"
+    #       GITEA__server__ROOT_URL: "https://{{ full_domain.value }}/"
+    #       GITEA__storage__MINIO_ACCESS_KEY_ID: "{{ minio_access_key }}"
+    #       GITEA__storage__MINIO_SECRET_ACCESS_KEY: "{{ minio_secret_key }}"
+    #     labels:
+    #       docker-volume-backup.stop-during-backup: "true"
+    #     volumes:
+    #       - /home/ssm-user/data:/var/lib/gitea
+    #       - /etc/timezone:/etc/timezone:ro
+    #       - /etc/localtime:/etc/localtime:ro

requirements.txt

@@ -14,7 +14,6 @@ charset-normalizer==3.4.1
 click==8.1.8
 cryptography==44.0.0
 filelock==3.16.1
-go-task-bin==3.44.1
 idna==3.10
 importlib_metadata==8.5.0
 Jinja2==3.1.5

router/Caddyfile

@@ -0,0 +1,3 @@
+code.maximhutz.com {
+	respond "WIP!"
+}

terraform/.terraform.lock.hcl

@@ -1,45 +0,0 @@
-# This file is maintained automatically by "terraform init".
-# Manual edits may be lost in future updates.
-
-provider "registry.terraform.io/hashicorp/aws" {
-  version = "6.27.0"
-  hashes = [
-    "h1:emgTfB1LXSFYh9uAwgsRMoMIN5Wz7jNNKq3rqC0EHWk=",
-    "zh:177a24b806c72e8484b5cabc93b2b38e3d770ae6f745a998b54d6619fd0e8129",
-    "zh:4ac4a85c14fb868a3306b542e6a56c10bd6c6d5a67bc0c9b8f6a9060cf5f3be7",
-    "zh:552652185bc85c8ba1da1d65dea47c454728a5c6839c458b6dcd3ce71c19ccfc",
-    "zh:60284b8172d09aee91eae0856f09855eaf040ce3a58d6933602ae17c53f8ed04",
-    "zh:6be38d156756ca61fb8e7c752cc5d769cd709686700ac4b230f40a6e95b5dbc9",
-    "zh:7a409138fae4ef42e3a637e37cb9efedf96459e28a3c764fc4e855e8db9a7485",
-    "zh:8070cf5224ed1ed3a3e9a59f7c30ff88bf071c7567165275d477c1738a56c064",
-    "zh:894439ef340a9a79f69cd759e27ad11c7826adeca27be1b1ca82b3c9702fa300",
-    "zh:89d035eebf08a97c89374ff06040955ddc09f275ecca609d0c9d58d149bef5cf",
-    "zh:985b1145d724fc1f38369099e4a5087141885740fd6c0b1dbc492171e73c2e49",
-    "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
-    "zh:a80b47ae8d1475201c86bd94a5dcb9dd4da5e8b73102a90820b68b66b76d50fd",
-    "zh:d3395be1556210f82199b9166a6b2e677cee9c4b67e96e63f6c3a98325ad7ab0",
-    "zh:db0b869d09657f6f1e4110b56093c5fcdf9dbdd97c020db1e577b239c0adcbce",
-    "zh:ffc72e680370ae7c21f9bd3082c6317730df805c6797427839a6b6b7e9a26a01",
-  ]
-}
-
-provider "registry.terraform.io/hetznercloud/hcloud" {
-  version     = "1.57.0"
-  constraints = "~> 1.45"
-  hashes = [
-    "h1:xpAcuja19Ts7bCpmULKdBw4dEBJhF/eL6AjM4xDBEAI=",
-    "zh:016ecc39328f34f6c0ffa413598f354824f7878c89cd031f123edb4bc8a687a2",
-    "zh:10b362dc0847200c987214b129b5f85e2f7d8ad417261a1d2dd04ab74de15603",
-    "zh:194647d9a61dca4f411f44580316b88a11095d7a99679d445f9b0f2c1ba976c4",
-    "zh:1d8aafe2ce7890696385bb3a0c3286e7ee3020416d337f59935406e4c6f91de6",
-    "zh:594585616210fb232fad4ebda2387ecd3f483931e00eff988fca83add6ce7cfc",
-    "zh:65e50be33ffb85580546f119839e1293591cc6d4db729d809931d0408b6ae408",
-    "zh:7d4ed5bd8c477ec304142e2160203a76a0d09c93d224950bda253172b2571038",
-    "zh:90a70a70a266b78c8216903e711904e6969b3957d182602b5d788602ec9ef323",
-    "zh:abb8e28e96fb8de270995873de980896b7cb53cfc550f02c50eaa42884624ba9",
-    "zh:bbf34dca2de6e105ca7204222162a0402d8e9e9a28e1de5ffbaa2c0d6270a059",
-    "zh:c1a9edb693d632dcb5c3c9ee84c97138e08eadb9354e28592efd581f68ac0385",
-    "zh:dadbf1368fae314fe8dcb99ebefbc78409f3fc0e3808cd92ea573b8eee1cae98",
-    "zh:e713e00ca27348abd18da2eeff861905e84050e3e7e008f14a0c63c70ab2ff84",
-  ]
-}

terraform/install.sh

@@ -1,31 +0,0 @@
-#!/bin/sh
-
-## Install extras.
-rpm --rebuilddb
-amazon-linux-extras install docker ansible2 python3.8 -y
-
-# Make Docker work.
-systemctl enable docker
-systemctl start docker
-
-# Set up the correct version of Python (for Ansible).
-ln -sf /usr/bin/python3.8 /usr/bin/python3
-ln -sf /usr/bin/pip3.8 /usr/bin/pip3
-pip3 install botocore boto3 requests packaging --user ssm-user
-python3 -m pip install -U pip
-
-# Add some swap space.
-dd if=/dev/zero of=/swapfile bs=128M count=8
-chmod 600 /swapfile
-mkswap /swapfile
-swapon /swapfile
-
-# Stop SSH (because we have SSM.)
-service sshd stop
-
-# Install Docker Compose.
-curl -L "https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
-chmod +x /usr/local/bin/docker-compose
-
-# ERROR: SSM User not created yet.
-sudo usermod -aG docker ssm-user

terraform/main.tf

@@ -1,82 +0,0 @@
-resource "hcloud_primary_ip" "public_ip" {
-  name          = "repository-public-ip"
-  datacenter    = local.datacenter
-  type          = "ipv4"
-  assignee_type = "server"
-  auto_delete   = false
-}
-
-resource "hcloud_ssh_key" "ssh_key" {
-  name       = "repository-ssh-key"
-  public_key = file(var.public_ssh_key_path)
-}
-
-resource "hcloud_server" "server_instance" {
-  name        = "repository-server"
-  image       = local.server_image
-  server_type = local.server_type
-  datacenter  = local.datacenter
-  ssh_keys    = [hcloud_ssh_key.ssh_key.id]
-
-  public_net {
-    ipv4_enabled = true
-    ipv4         = hcloud_primary_ip.public_ip.id
-    ipv6_enabled = false
-  }
-}
-
-resource "hcloud_firewall" "server_firewall" {
-  name = "repository-server-firewall"
-
-  # Allow ICMP.
-  rule {
-    direction  = "in"
-    protocol   = "icmp"
-    source_ips = ["0.0.0.0/0", "::/0"]
-  }
-
-  # Allow all out.
-  rule {
-    direction       = "out"
-    protocol        = "tcp"
-    port            = "any"
-    destination_ips = ["0.0.0.0/0", "::/0"]
-  }
-
-  # Poke holes for applications, and SSH.
-  dynamic "rule" {
-    for_each = ["80", "443", "22", "2222"]
-
-    content {
-      direction  = "in"
-      protocol   = "tcp"
-      port       = rule.value
-      source_ips = ["0.0.0.0/0", "::/0"]
-    }
-  }
-}
-
-resource "hcloud_firewall_attachment" "server_fw_attachment" {
-  firewall_id = hcloud_firewall.server_firewall.id
-  server_ids  = [hcloud_server.server_instance.id]
-}
-
-resource "hcloud_server" "runner_instance" {
-  name        = "runner-server"
-  image       = local.server_image
-  server_type = local.server_type
-  datacenter  = local.datacenter
-  ssh_keys    = [hcloud_ssh_key.ssh_key.id]
-
-  public_net {
-    ipv4_enabled = false
-    ipv6_enabled = false
-  }
-
-  network {
-    network_id = hcloud_network.private_network.id
-    ip         = local.runner_ip
-  }
-
-  depends_on = [hcloud_network_subnet.private_subnet]
-}

terraform/network.tf

@@ -1,24 +0,0 @@
-resource "hcloud_network" "private_network" {
-  name     = "repository-network"
-  ip_range = local.network_cidr
-}
-
-resource "hcloud_network_subnet" "private_subnet" {
-  network_id   = hcloud_network.private_network.id
-  type         = "cloud"
-  network_zone = local.network_zone
-  ip_range     = local.subnet_cidr
-}
-
-resource "hcloud_server_network" "server_network" {
-  server_id  = hcloud_server.server_instance.id
-  network_id = hcloud_network.private_network.id
-  ip         = local.server_ip
-}
-
-resource "hcloud_network_route" "nat_route" {
-  network_id  = hcloud_network.private_network.id
-  destination = "0.0.0.0/0"
-  gateway     = local.server_ip
-}
-

terraform/outputs.tf

@@ -1,17 +0,0 @@
-output "server_ip" {
-  description = "The public address of the server."
-  value       = hcloud_server.server_instance.ipv4_address
-  sensitive   = false
-}
-
-output "server_fqdn" {
-  description = "The public domain of the server."
-  value       = "${local.subdomain}.${local.domain}"
-  sensitive   = false
-}
-
-output "runner_ip" {
-  description = "The private network address of the runner."
-  value       = local.runner_ip
-  sensitive   = false
-}

terraform/providers.tf

@@ -1,24 +0,0 @@
-terraform {
-  backend "s3" {
-    skip_credentials_validation = true
-    skip_region_validation      = true
-    skip_requesting_account_id  = true
-  }
-
-  required_providers {
-    hcloud = {
-      source  = "hetznercloud/hcloud"
-      version = "~> 1.57"
-    }
-  }
-}
-
-provider "hcloud" {
-  token = var.hcloud_token
-}
-
-provider "aws" {
-  region     = var.aws_region
-  access_key = var.aws_access_key
-  secret_key = var.aws_secret_key
-}

terraform/variables.tf

@@ -1,45 +0,0 @@
-locals {
-  datacenter   = "hel1-dc2"
-  server_type  = "cx23"
-  server_image = "debian-12"
-
-  domain    = "maximhutz.com"
-  subdomain = "git"
-
-  network_zone = "eu-central"
-  network_cidr = "10.0.0.0/16"
-  subnet_cidr  = "10.0.1.0/24"
-  server_ip    = "10.0.1.2"
-  runner_ip    = "10.0.1.3"
-}
-
-# ---------------------------------------------------------------------------- #
-
-variable "hcloud_token" {
-  sensitive   = true
-  description = "The hCloud token used to access Hetzner resources."
-  type        = string
-}
-
-variable "public_ssh_key_path" {
-  description = "The location of the public key used to access the repository server."
-  type        = string
-}
-
-variable "aws_region" {
-  description = "The region of the AWS account."
-  type        = string
-  sensitive   = true
-}
-
-variable "aws_access_key" {
-  description = "The access key of the account."
-  type        = string
-  sensitive   = true
-}
-
-variable "aws_secret_key" {
-  description = "The secret key of the account."
-  type        = string
-  sensitive   = true
-}

variables.yml

@@ -1,2 +0,0 @@
-variables:
-  image_name: mvhutz/gitea

vault.yml

@@ -1,73 +1,6 @@
 $ANSIBLE_VAULT;1.1;AES256
-61653436663266303862366531643735316166303031643931616464323034653564316364616664
-3161386538393961346666383461636364393464333565340a616436303039623931303365333931
-36303933303862316236376537346533313330316239336366363430386161363162323435383330
-3561373930663862390a666133383630326464356561383566653035363938643461613964353261
-66653633616233646361656233363263633438336662386461623439323466353030336364313663
-36383037313238303365363162653731323663653932646465303837643532363238653239646536
-35623334346434646463396565313866333862316430613336323734323232623632323865646236
-34613666363465663138343733663634636436326130303730333666623232356261353861343064
-38653063346138313435393461393361643462656264656531643338323631323865363731303564
-34623132663634336362373730313664613238323130626261383762353933373166643063396563
-36636230323565396361386164653037623532373166623665363234383261376464396163643862
-37356338313638396261653637663930656236366666346365343335303239333265333665356335
-38363062353462636636303735643961626462396439663864636230333134303233616436373765
-62633361643737633535303435343566613630316562303132393062623532353366366531653164
-61386634653463653164336532303732636335343266346264363361623166376533643962623563
-38643830316333356133653334366332653235383965383766373665356139313438663631373063
-64313764353536633466393764323062363531373038306437396665383134373635623363663239
-38623461303165306132323430316436653664643166653764386663393662306339616666353338
-37366631383937623064653534613930306331303565623366353263613537306636353732313964
-31376430386234353735353866376332356561353761333461616463663831313364666437646139
-62643233373066343363316362613236393333646634666366316530623537313633653236393336
-37323831313834626263303933343132343535336661363563336235313038653330323061616365
-64323431306234306266346564346462663335313830366435356433303837363130643034336131
-63643036343631343862376262333362396137396366663031653263313462656662363066313461
-63666666373835633936313332613030303863386563376638316565613230633762666337646538
-30313837356636636333663032666166636364376537336132393765306339376639643238303537
-35376336393931643634633134303463653036393435383234353863613266663166336235393431
-61333134393035613835356462303232366164653865393861333965646535376132633061383531
-37616139633431383463373836636337623434366161366262326534346163366638353164646132
-62616338646530376264633038373765373138346334626237386662616466636533376165613133
-39613134346130623137396536353564616165376632623736353435643133313565306234333631
-30393861343338393031323765306332363634343830333965333131326536363361303839633238
-31643430613838353838363065333264313330313934316130313835326562646465656264313738
-30333035633733626561316162633137623139343064316264383066656566613164306166613266
-31393966373865366263303031343638326565336665376131366231353364386163346662343037
-39306439633264386534643732346637323039313566653864323764663332363437316135383537
-35396439306533306334303466616136643762656463393435376534383835636530663565663663
-31353836626536613466363363643638323433626531623636353735393530373638313465356162
-33373466333363393634363935613034373436653133313835396133363766663135366633633661
-35353032656239663930363230373135663562356532633838613639666539376632383239316533
-62366230313762303335616462343566396466653565306130346538653530363261616262353539
-31356336316436396461626631623536356433343838633034646630343930373565666139613338
-31343163373466666532346436313535353736613965653539613930343463336231323932393163
-37623533613836616437653638633638313362623638636437383762396438623631326462313834
-36326133376331383464356364633031346639343165333461663538376336306539336438323361
-39336536373163306632373531643563656534623838373639313164313239663966653236663434
-37313439383032663033313135333765353833613665356139343631653861643264646562316630
-63333234393363323833613438323133663531633733303864366636393961333662316439616263
-39623039613339653930653732383363343530343539623437663836323538646136653465633764
-34336237386237646533626236653262626539323866393830636532353462373730363232663366
-63623631616236323037383635376261623439386532303631653861613433653064633137666365
-36636566623563363764343232373731383564366233303536373266326637396133376462656166
-36396264343464306233616561656535356463353334396435386464653935373862653035393237
-38666362353462643930363361326634396166316334326362363165356264383063313137353834
-30616336303761626236653836653332623738303261393632363930376232343434393764363365
-66316134643039393235383562356232323161623835653365393232616332313837303064323336
-30666330623432373536616433653164363639613363363963383262663939613564323334343636
-38626263626265626137336231343231306437333732303639393138663535613533346433306434
-66363032666162313538306631643430376465316536653631353530303038623536633034613335
-32343233643436323863376163366439613239633665626264663463633766366639643835653031
-38643439323666313663383662383161326633316161313030653835363863646264656437316436
-39316461663238393330643535313137626432386566373163363363363432363061376462363031
-63373163633530653133373830363061623739333338643561353330366331636333393638663738
-66303831626165396533353035396464363861623462333033636536336536636138363633613033
-62376236373231306238633266396335346439363334376464636664386361313263303865323365
-31616630623934363761636532666433393233313161646666613330616565623562346534653563
-63396563346162643565356330383436323461313665336437303866353939373334663062633437
-34393763323935353433336133666138326235653037636465333463313830623433656634393061
-65656462663061386361633638393232306165346663363931353036346439643365373930306466
-37666531303637383165653737633736303235613863343733663965616237356661643961653637
-64373634393030386337373535613238303431613739613337663337313338626431643165656239
-34623164636363366333
+66386561623561353461656662653566353665646466336635626561303031383735636666623063
+3336313938313562323336383765323932666638373232390a653163323131323564306438363864
+31333632326135353966656363633962616165623036373764646433353966616364376162636234
+3837333961383333640a383732346534346465353062653531353638663465306432396266663534
+3731