feat: stuff

.gitignore

@@ -213,5 +213,3 @@ cython_debug/
 *secret*
 .vscode
 .DS_Store
-*.key
-*.out

Taskfile.yml

@@ -1,26 +1,21 @@
 version: 3
 
+includes:
+  tf: { taskfile: terraform, dir: terraform }
+
 tasks:
   dev:
-    - docker compose down
-    - docker volume prune -f
-    - docker compose up --build --force-recreate
-
-  vault: ansible-vault edit vault.yml {{.CLI_ARGS}}
-  provision: ansible-playbook playbooks/provision.yml {{.CLI_ARGS}}
-  deploy: ansible-playbook playbooks/deploy.yml {{.CLI_ARGS}}
-  restore: ansible-playbook playbooks/restore.yml {{.CLI_ARGS}}
-
-  assets:
-    - cp ./assets/icon.png ./gitea/custom/public/assets/img/logo.png
-    - cp ./assets/icon.svg ./gitea/custom/public/assets/img/logo.svg
-    - cp ./assets/logo.png ./gitea/custom/public/assets/img/favicon.png
-    - cp ./assets/logo.svg ./gitea/custom/public/assets/img/favicon.svg
-    - cp ./assets/logo.png ./gitea/custom/public/assets/img/apple-touch-icon.png
+    - docker compose -f compose.dev.yml rm -fsv
+    - docker compose -f compose.dev.yml up --build --force-recreate --no-deps
 
+  deploy:fast: ansible-playbook playbooks/fast.yml
+  deploy:slow: ansible-playbook playbooks/slow.yml
+  deploy:restore: ansible-playbook playbooks/restore.yml -e "restore_bucket={{.BUCKET}} restore_key={{.KEY}}"
 
   enter:
-    cmd: ssh -i {{.KEY}} -p 2222 root@{{.IP}}
-    vars:
-      KEY: { sh: ansible-vault view vault.yml | yq -r ".secret.private_ssh_key_path" }
-      IP: { sh: cat dist/terraform_outputs.yml | jq -r ".server_ip.value" }
+    cmd: aws ssm start-session --target $INSTANCE_ID
+    env:
+      INSTANCE_ID: { sh: jq -r .instance_id.value < config/infrastructure.secret.json }
+      AWS_REGION: { sh: jq -r .aws_region < config/ansible.secret.json }
+      AWS_ACCESS_KEY_ID: { sh: jq -r .aws_access_key < config/ansible.secret.json }
+      AWS_SECRET_ACCESS_KEY: { sh: jq -r .aws_secret_key < config/ansible.secret.json }

ansible.cfg

@@ -1,13 +1,6 @@
 [defaults]
 callbacks_enabled = profile_tasks
 localhost_warning = False
-vault_password_file = vault.key
-interpreter_python = /usr/bin/python3.11
 
 [inventory]
 inventory_unparsed_warning = False
-
-[ssh_connection]
-ssh_args = -o ControlMaster=auto -o ControlPersist=60s -o ForwardAgent=yes -o IdentityAgent=none
-pipelining = True
-retries = 2

compose.dev.yml

@@ -3,6 +3,7 @@ services:
   # Gitea itself.
   gitea:
     container_name: web-git-instance
+    restart: unless-stopped
     depends_on:
       - backup
       - bucket-script

gitea/Dockerfile

@@ -4,4 +4,3 @@ ADD --chown=git:git config /etc/gitea
 ADD --chown=git:git custom /etc/gitea-custom
 
 ENV GITEA_CUSTOM=/etc/gitea-custom
-ENV BUCKET_KEY=""

gitea/config/app.ini

@@ -4,7 +4,7 @@ RUN_MODE = prod
 WORK_PATH = /var/lib/gitea
 
 [ui]
-DEFAULT_THEME = gitea-light
+DEFAULT_THEME = gitea-dark
 
 [repository]
 ROOT = /var/lib/gitea/git/repositories
@@ -24,12 +24,16 @@ DISABLE_SSH = false
 START_SSH_SERVER = true
 SSH_PORT = 22
 SSH_LISTEN_PORT = 22
+# SSH_DOMAIN = %(FULL_DOMAIN)s
 BUILTIN_SSH_SERVER_USER = git
 
 PROTOCOL=https
 ENABLE_ACME=true
 ACME_ACCEPTTOS=true
 ACME_DIRECTORY=https
+# ACME_EMAIL=%(EMAIL)s
+# DOMAIN = %(FULL_DOMAIN)s
+# ROOT_URL = %(ROOT_URL)s
 HTTP_PORT = 443
 
 [database]
@@ -93,5 +97,7 @@ DEFAULT_TRUST_MODEL = committer
 
 [storage]
 STORAGE_TYPE = minio
+MINIO_ENDPOINT = s3.us-east-1.amazonaws.com
+MINIO_BUCKET = myrica-faya
 MINIO_USE_SSL = true
 MINIO_INSECURE_SKIP_VERIFY = false

gitea/config/dev.app.ini

@@ -4,7 +4,7 @@ RUN_MODE = prod
 WORK_PATH = /var/lib/gitea
 
 [ui]
-DEFAULT_THEME = gitea-light
+DEFAULT_THEME = gitea-dark
 
 [repository]
 ROOT = /var/lib/gitea/git/repositories

gitea/custom/templates/home.tmpl

@@ -2,7 +2,7 @@
 <div role="main"
   aria-label="{{if .IsSigned}}{{ctx.Locale.Tr "dashboard"}}{{else}}{{ctx.Locale.Tr "home"}}{{end}}" class="page-content home">
   <div class="tw-mb-8 tw-px-8">
-    <div class="center tw-gap-4">
+    <div class="center">
       <img class="logo" width="220" height="220" src="{{AssetUrlPrefix}}/img/logo.svg" alt="{{ctx.Locale.Tr "logo"}}">
       <div class="hero">
         <h1 class="ui icon header title">{{AppName}}</h1>

playbooks/deploy.yml

@@ -1,201 +0,0 @@
-- name: Set up for fresh host.
-  gather_facts: false
-  hosts: localhost
-  vars_files:
-    - ../vault.yml
-    - ../dist/terraform_outputs.yml
-  tasks:
-    - name: Add remote host.
-      ansible.builtin.add_host:
-        name: server_fresh
-        ansible_ssh_host: "{{ server_ip.value }}"
-        ansible_user: root
-        ansible_port: 22
-        ansible_private_key_file: "{{ secret.private_ssh_key_path }}"
-
-- name: Switch port to 2222.
-  hosts: server_fresh
-  ignore_unreachable: true
-  gather_facts: false
-  tasks:
-    - name: Update SSH port.
-      ansible.builtin.lineinfile:
-        dest: "/etc/ssh/sshd_config"
-        regexp: "^Port"
-        line: "Port 2222"
-
-    - name: Restart service.
-      ansible.builtin.service:
-        name: ssh
-        state: restarted
-
-- name: Set up real host.
-  gather_facts: false
-  hosts: localhost
-  tags:
-    - deploy
-  vars_files:
-    - ../vault.yml
-    - ../dist/terraform_outputs.yml
-  tasks:
-    - name: Add remote host.
-      ansible.builtin.add_host:
-        name: server
-        ansible_ssh_host: "{{ server_ip.value }}"
-        ansible_user: root
-        ansible_port: 2222
-        ansible_private_key_file: "{{ secret.private_ssh_key_path }}"
-
-- name: Install Docker.
-  gather_facts: true
-  hosts: server
-  vars_files:
-    - ../vault.yml
-    - ../dist/terraform_outputs.yml
-  tasks:
-    - name: Install PIP.
-      ansible.builtin.apt:
-        state: present
-        update_cache: true
-        name:
-          - python3-pip
-
-    - name: Install needed packages.
-      ansible.builtin.pip:
-        name:
-          - botocore
-          - boto3
-          - packaging
-        state: present
-        break_system_packages: true
-
-    - name: Download Docker repository key.
-      ansible.builtin.apt_key:
-        url: https://download.docker.com/linux/debian/gpg
-        state: present
-
-    - name: Download Docker repository.
-      ansible.builtin.apt_repository:
-        repo: "deb https://download.docker.com/linux/debian {{ ansible_distribution_release }} stable"
-        state: present
-
-    - name: Remove bad packages.
-      ansible.builtin.apt:
-        state: absent
-        package:
-          - docker.io
-          - docker-doc
-          - docker-compose
-          - podman-docker
-          - containerd
-          - runc
-
-    - name: Download Docker dependencies.
-      ansible.builtin.apt:
-        state: present
-        package:
-          - ca-certificates
-          - curl
-
-    - name: Download Docker packages.
-      ansible.builtin.apt:
-        state: present
-        update_cache: true
-        package:
-          - docker-ce
-          - docker-ce-cli
-          - containerd.io
-          - docker-buildx-plugin
-          - docker-compose-plugin
-
-- name: Deploy artifact to instance.
-  hosts: server
-  tags:
-    - deploy
-  gather_facts: false
-  vars_files:
-    - ../variables.yml
-    - ../vault.yml
-    - ../dist/terraform_outputs.yml
-  tasks:
-    - name: Copy gitea folder.
-      ansible.builtin.copy:
-        src: ../gitea/
-        dest: /root/gitea/
-        mode: preserve
-
-    - name: Build image.
-      community.docker.docker_image_build:
-        name: "{{ variables.image_name }}"
-        path: /root/gitea
-        nocache: true
-        rebuild: always
-        pull: true
-
-    - name: Create data directory.
-      ansible.builtin.file:
-        path: /root/data
-        state: directory
-        mode: '0777'
-
-    - name: Run image.
-      community.docker.docker_container:
-        name: server
-        image: "{{ variables.image_name }}"
-        state: started
-        recreate: true
-        restart_policy: unless-stopped
-        memory: 425m
-        memory_swap: 900m
-        ports: [80:80, 443:443, "22:22"]
-        env:
-          # Secrets.
-          GITEA__security__INTERNAL_TOKEN: "{{ secret.internal }}"
-          GITEA__server__LFS_JWT_SECRET: "{{ secret.lfs }}"
-          GITEA__oauth2__JWT_SECRET: "{{ secret.jwt }}"
-          GITEA__server__ACME_EMAIL: "acme@maximhutz.me"
-          GITEA__server__SSH_DOMAIN: "{{ server_fqdn.value }}"
-          GITEA__server__DOMAIN: "{{ server_fqdn.value }}"
-          GITEA__server__ROOT_URL: "https://{{ server_fqdn.value }}/"
-
-          # General S3 storage information.
-          GITEA__storage__MINIO_BUCKET: "{{ secret.bucket.name }}"
-          GITEA__storage__MINIO_ENDPOINT: "{{ secret.bucket.endpoint }}"
-          GITEA__storage__MINIO_ACCESS_KEY_ID: "{{ secret.bucket.access_key }}"
-          GITEA__storage__MINIO_SECRET_ACCESS_KEY: "{{ secret.bucket.secret_key }}"
-
-          # Set storage to specific S3 bucket path.
-          GITEA__storage_0x2E_attachments__MINIO_BASE_PATH: "{{ secret.storage.key }}/attachments"
-          GITEA__storage_0x2E_lfs__MINIO_BASE_PATH: "{{ secret.storage.key }}/lfs"
-          GITEA__storage_0x2E_avatars__MINIO_BASE_PATH: "{{ secret.storage.key }}/avatars"
-          GITEA__storage_0x2E_repo_0X2D_archive___MINIO_BASE_PATH: "{{ secret.storage.key }}/repo-archive"
-          GITEA__storage_0x2E_repo_0X2D_avatars__MINIO_BASE_PATH: "{{ secret.storage.key }}/repo-avatars"
-          GITEA__storage_0x2E_packages__MINIO_BASE_PATH: "{{ secret.storage.key }}/packages"
-          GITEA__storage_0x2E_actions_log__MINIO_BASE_PATH: "{{ secret.storage.key }}/actions_log"
-          GITEA__storage_0x2E_actions_artifacts__MINIO_BASE_PATH: "{{ secret.storage.key }}/actions_artifacts"
-
-        labels:
-          docker-volume-backup.stop-during-backup: "true"
-        volumes:
-          - /root/data:/var/lib/gitea
-          - /etc/timezone:/etc/timezone:ro
-          - /etc/localtime:/etc/localtime:ro
-
-    - name: Run backup.
-      community.docker.docker_container:
-        name: backup
-        image: offen/docker-volume-backup:v2
-        state: started
-        recreate: true
-        restart_policy: unless-stopped
-        volumes:
-          - /root/data:/backup/my-app-backup:ro
-          - /var/run/docker.sock:/var/run/docker.sock:ro
-        env:
-          AWS_S3_BUCKET_NAME: "{{ secret.bucket.name }}"
-          AWS_S3_PATH: "{{ secret.backup.key }}"
-          AWS_REGION: "{{ secret.bucket.region }}"
-          AWS_ACCESS_KEY_ID: "{{ secret.bucket.access_key }}"
-          AWS_SECRET_ACCESS_KEY: "{{ secret.bucket.secret_key }}"
-          AWS_ENDPOINT: "{{ secret.bucket.endpoint }}"
-          BACKUP_CRON_EXPRESSION: "0 0 * * *"

playbooks/fast.yml

@@ -0,0 +1,91 @@
+- name: Make build artifact.
+  hosts: localhost
+  vars_files:
+    - ../config/ansible.secret.json
+    - ../config/infrastructure.secret.json
+  gather_facts: false
+  tasks:
+    - name: Log into Docker.
+      community.docker.docker_login:
+        registry_url: '{{ full_domain.value }}'
+        username: '{{ username }}'
+        password: '{{ api_key }}'
+        reauthorize: true
+
+    - name: Build image.
+      community.docker.docker_image_build:
+        name: "{{ full_domain.value }}/{{ image_name }}:latest"
+        path: ../gitea
+        nocache: true
+        rebuild: always
+        pull: true
+        outputs: [{ type: image, push: true }]
+        platform:
+          - linux/amd64
+          - linux/arm64/v8
+
+    - name: Log out of Docker.
+      community.docker.docker_login:
+        state: absent
+
+- name: Deploy artifact to instance.
+  hosts: localhost
+  become: true
+  gather_facts: false
+  vars_files:
+    - ../config/ansible.secret.json
+    - ../config/infrastructure.secret.json
+  vars:
+    ansible_connection: aws_ssm
+    ansible_aws_ssm_plugin: "{{ ssm_plugin }}"
+    ansible_aws_ssm_bucket_name: "{{ image_bucket }}"
+    ansible_aws_ssm_instance_id: "{{ instance_id.value }}"
+    ansible_python_interpreter: /usr/bin/python3
+    ansible_aws_ssm_region: "{{ aws_region }}"
+    ansible_aws_ssm_access_key_id: "{{ aws_access_key }}"
+    ansible_aws_ssm_secret_access_key: "{{ aws_secret_key }}"
+  tasks:
+    - name: Run image.
+      community.docker.docker_container:
+        name: server
+        image: "{{ full_domain.value }}/{{ image_name }}:latest"
+        state: started
+        recreate: true
+        restart_policy: unless-stopped
+        memory: 300m
+        memory_swap: 900m
+        ports: [80:80, 2222:2222, 443:443, "22:22"]
+        env:
+          GITEA__security__INTERNAL_TOKEN: "{{ internal_secret }}"
+          GITEA__server__LFS_JWT_SECRET: "{{ lfs_secret }}"
+          GITEA__oauth2__JWT_SECRET: "{{ jwt_secret }}"
+          GITEA__server__ACME_EMAIL: "{{ email }}"
+          GITEA__server__SSH_DOMAIN: "{{ full_domain.value }}"
+          GITEA__server__DOMAIN: "{{ full_domain.value }}"
+          GITEA__server__ROOT_URL: "https://{{ full_domain.value }}/"
+          GITEA__storage__MINIO_ACCESS_KEY_ID: "{{ minio_access_key }}"
+          GITEA__storage__MINIO_SECRET_ACCESS_KEY: "{{ minio_secret_key }}"
+        labels:
+          docker-volume-backup.stop-during-backup: "true"
+        volumes:
+          - /home/ssm-user/data:/var/lib/gitea
+          - /etc/timezone:/etc/timezone:ro
+          - /etc/localtime:/etc/localtime:ro
+
+    - name: Run backup.
+      community.docker.docker_container:
+        name: backup
+        image: offen/docker-volume-backup:v2
+        state: started
+        recreate: true
+        restart_policy: unless-stopped
+        volumes:
+          - /home/ssm-user/data:/backup/my-app-backup:ro
+          - /var/run/docker.sock:/var/run/docker.sock:ro
+        env:
+          AWS_S3_BUCKET_NAME: "{{ boot_bucket }}"
+          AWS_S3_PATH: "{{ boot_key }}"
+          AWS_REGION: "{{ boot_region.value }}"
+          AWS_ACCESS_KEY_ID: "{{ boot_id.value }}"
+          AWS_SECRET_ACCESS_KEY: "{{ boot_secret.value }}"
+          BACKUP_CRON_EXPRESSION: "0 0 * * *"

playbooks/provision.yml

@@ -1,39 +0,0 @@
-- name: Deploy terraform infrastructure.
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - ../vault.yml
-  tasks:
-    - name: Reconfigure and plan.
-      community.general.terraform:
-        project_path: '../terraform'
-        state: "planned"
-        plan_file: plan.out
-        init_reconfigure: true
-        force_init: true
-        backend_config: "{{ terraform.backend }}"
-        variables: "{{ terraform.variables }}"
-        complex_vars: true
-
-    - name: Apply.
-      community.general.terraform:
-        project_path: '../terraform'
-        state: "present"
-        plan_file: plan.out
-        backend_config: "{{ terraform.backend }}"
-        variables: "{{ terraform.variables }}"
-        complex_vars: true
-      register: terraform_apply
-
-    - name: Create secret directory.
-      ansible.builtin.file:
-        path: ../dist
-        recurse: true
-        mode: "0755"
-        state: directory
-
-    - name: Send outputs to file.
-      ansible.builtin.copy:
-        content: "{{ terraform_apply.outputs }}"
-        dest: ../dist/terraform_outputs.yml
-        mode: '0755'

playbooks/restore.yml

@@ -1,25 +1,19 @@
-- name: Set up real host.
-  gather_facts: false
-  hosts: localhost
-  vars_files:
-    - ../vault.yml
-    - ../dist/terraform_outputs.yml
-  tasks:
-    - name: Add remote host.
-      ansible.builtin.add_host:
-        name: server
-        ansible_ssh_host: "{{ server_ip.value }}"
-        ansible_user: root
-        ansible_port: 2222
-        ansible_private_key_file: "{{ secret.private_ssh_key_path }}"
-
 - name: Deploy artifact to instance.
-  hosts: server
+  hosts: localhost
   become: true
   gather_facts: false
   vars_files:
-    - ../vault.yml
-    - ../dist/terraform_outputs.yml
+    - ../config/ansible.secret.json
+    - ../config/infrastructure.secret.json
+  vars:
+    ansible_connection: aws_ssm
+    ansible_python_interpreter: /usr/bin/python3
+    ansible_aws_ssm_plugin: "{{ ssm_plugin }}"
+    ansible_aws_ssm_bucket_name: "{{ image_bucket }}"
+    ansible_aws_ssm_instance_id: "{{ instance_id.value }}"
+    ansible_aws_ssm_region: "{{ aws_region }}"
+    ansible_aws_ssm_access_key_id: "{{ aws_access_key }}"
+    ansible_aws_ssm_secret_access_key: "{{ aws_secret_key }}"
   tasks:
     - name: Stop server.
       community.docker.docker_container:
@@ -28,39 +22,38 @@
       loop: [server, backup]
 
     - name: Copy backup from S3.
+      environment:
+        region: "{{ boot_region.value }}"
+        access_key: "{{ boot_id.value }}"
+        secret_key: "{{ boot_secret.value }}"
       amazon.aws.s3_object:
-        bucket: "{{ secret.restore.bucket | mandatory(msg='You must specify the bucket of the data.') }}"
-        object: "{{ secret.restore.key | mandatory(msg='You must specify the key of the data.') }}"
-        dest: /root/snapshot.tar.gz
+        bucket: "{{ restore_bucket | mandatory(msg='You must specify the bucket of the data.') }}"
+        object: "{{ restore_key | mandatory(msg='You must specify the key of the data.') }}"
+        dest: /home/ssm-user/backup.tar.gz
         mode: get
-        region: "{{ secret.restore.region }}"
-        access_key: "{{ secret.restore.access_key }}"
-        secret_key: "{{ secret.restore.secret_key }}"
-        endpoint_url: "{{ secret.restore.endpoint | mandatory(msg='You must specify the S3 URL.') }}"
-        ignore_nonexistent_bucket: true
 
     - name: Ensure backup directory exists.
       ansible.builtin.file:
-        path: /root/restore
+        path: /home/ssm-user/backup
         state: directory
         mode: '0777'
 
     - name: Extract backup.
       ansible.builtin.unarchive:
-        src: /root/snapshot.tar.gz
-        dest: /root/restore
+        src: /home/ssm-user/backup.tar.gz
+        dest: /home/ssm-user/backup
         remote_src: true
 
     - name: Move backup files to data folder.
       ansible.builtin.copy:
         remote_src: true
-        src: /root/restore/backup/my-app-backup/
-        dest: /root/data/
+        src: /home/ssm-user/backup/backup/my-app-backup/
+        dest: /home/ssm-user/data/
         mode: '0777'
 
     - name: Update permissions.
       ansible.builtin.file:
-        path: /root/data
+        path: /home/ssm-user/data
         recurse: true
         mode: '0777'
         owner: 1000

playbooks/slow.yml

@@ -0,0 +1,121 @@
+- name: Make build artifact.
+  hosts: localhost
+  vars_files: ../config/ansible.secret.json
+  gather_facts: false
+  tasks:
+    - name: Build image.
+      community.docker.docker_image_build:
+        name: "{{ image_name }}"
+        path: ../gitea
+        nocache: true
+        rebuild: always
+        pull: true
+
+    - name: Push image to archive.
+      community.docker.docker_image:
+        name: "{{ image_name }}"
+        archive_path: ../dist/image.tar
+        source: local
+
+    - name: Compress archive to artifact.
+      register: compress_image
+      community.general.archive:
+        path: ../dist/image.tar
+        dest: ../dist/image.tar.xz
+        format: xz
+        mode: "0644"
+
+    - name: Push artifact to S3.
+      amazon.aws.s3_object:
+        bucket: "{{ image_bucket }}"
+        object: "{{ image_key }}"
+        src: ../dist/image.tar.xz
+        mode: put
+
+        region: "{{ aws_region }}"
+        access_key: "{{ aws_access_key }}"
+        secret_key: "{{ aws_secret_key }}"
+
+- name: Deploy artifact to instance.
+  hosts: localhost
+  become: true
+  gather_facts: false
+  vars_files:
+    - ../config/ansible.secret.json
+    - ../config/infrastructure.secret.json
+  vars:
+    ansible_connection: aws_ssm
+    ansible_python_interpreter: /usr/bin/python3
+    ansible_aws_ssm_plugin: "{{ ssm_plugin }}"
+    ansible_aws_ssm_bucket_name: "{{ image_bucket }}"
+    ansible_aws_ssm_instance_id: "{{ instance_id.value }}"
+    ansible_aws_ssm_region: "{{ aws_region }}"
+    ansible_aws_ssm_access_key_id: "{{ aws_access_key }}"
+    ansible_aws_ssm_secret_access_key: "{{ aws_secret_key }}"
+  tasks:
+    - name: Fetch image.
+      amazon.aws.s3_object:
+        mode: get
+        bucket: "{{ image_bucket }}"
+        object: "{{ image_key }}"
+        dest: /root/image.tar.gz
+
+        region: "{{ aws_region }}"
+        access_key: "{{ aws_access_key }}"
+        secret_key: "{{ aws_secret_key }}"
+
+    - name: Create data directory.
+      ansible.builtin.file:
+        path: /home/ssm-user/data
+        state: directory
+        mode: '0777'
+
+    - name: Load image.
+      community.docker.docker_image_load:
+        path: /root/image.tar.gz
+      register: image
+
+    - name: Run image.
+      community.docker.docker_container:
+        name: server
+        image: "{{ image.image_names[0] }}"
+        state: started
+        recreate: true
+        restart_policy: unless-stopped
+        memory: 300m
+        memory_swap: 900m
+        ports: [80:80, 2222:2222, 443:443, "22:22"]
+        env:
+          GITEA__security__INTERNAL_TOKEN: "{{ internal_secret }}"
+          GITEA__server__LFS_JWT_SECRET: "{{ lfs_secret }}"
+          GITEA__oauth2__JWT_SECRET: "{{ jwt_secret }}"
+          GITEA__server__ACME_EMAIL: "{{ email }}"
+          GITEA__server__SSH_DOMAIN: "{{ full_domain.value }}"
+          GITEA__server__DOMAIN: "{{ full_domain.value }}"
+          GITEA__server__ROOT_URL: "https://{{ full_domain.value }}/"
+          GITEA__storage__MINIO_ACCESS_KEY_ID: "{{ minio_access_key }}"
+          GITEA__storage__MINIO_SECRET_ACCESS_KEY: "{{ minio_secret_key }}"
+        labels:
+          docker-volume-backup.stop-during-backup: "true"
+        volumes:
+          - /home/ssm-user/data:/var/lib/gitea
+          - /etc/timezone:/etc/timezone:ro
+          - /etc/localtime:/etc/localtime:ro
+
+    - name: Run backup.
+      community.docker.docker_container:
+        name: backup
+        image: offen/docker-volume-backup:v2
+        state: started
+        recreate: true
+        restart_policy: unless-stopped
+        volumes:
+          - /home/ssm-user/data:/backup/my-app-backup:ro
+          - /var/run/docker.sock:/var/run/docker.sock:ro
+        env:
+          AWS_S3_BUCKET_NAME: "{{ boot_bucket }}"
+          AWS_S3_PATH: "{{ boot_key }}"
+          AWS_REGION: "{{ boot_region.value }}"
+          AWS_ACCESS_KEY_ID: "{{ boot_id.value }}"
+          AWS_SECRET_ACCESS_KEY: "{{ boot_secret.value }}"
+          BACKUP_CRON_EXPRESSION: "0 0 * * *"

requirements.txt

@@ -14,7 +14,6 @@ charset-normalizer==3.4.1
 click==8.1.8
 cryptography==44.0.0
 filelock==3.16.1
-go-task-bin==3.44.1
 idna==3.10
 importlib_metadata==8.5.0
 Jinja2==3.1.5

terraform/.terraform.lock.hcl

@@ -2,44 +2,23 @@
 # Manual edits may be lost in future updates.
 
 provider "registry.terraform.io/hashicorp/aws" {
-  version = "6.27.0"
+  version = "5.83.1"
   hashes = [
-    "h1:emgTfB1LXSFYh9uAwgsRMoMIN5Wz7jNNKq3rqC0EHWk=",
-    "zh:177a24b806c72e8484b5cabc93b2b38e3d770ae6f745a998b54d6619fd0e8129",
-    "zh:4ac4a85c14fb868a3306b542e6a56c10bd6c6d5a67bc0c9b8f6a9060cf5f3be7",
-    "zh:552652185bc85c8ba1da1d65dea47c454728a5c6839c458b6dcd3ce71c19ccfc",
-    "zh:60284b8172d09aee91eae0856f09855eaf040ce3a58d6933602ae17c53f8ed04",
-    "zh:6be38d156756ca61fb8e7c752cc5d769cd709686700ac4b230f40a6e95b5dbc9",
-    "zh:7a409138fae4ef42e3a637e37cb9efedf96459e28a3c764fc4e855e8db9a7485",
-    "zh:8070cf5224ed1ed3a3e9a59f7c30ff88bf071c7567165275d477c1738a56c064",
-    "zh:894439ef340a9a79f69cd759e27ad11c7826adeca27be1b1ca82b3c9702fa300",
-    "zh:89d035eebf08a97c89374ff06040955ddc09f275ecca609d0c9d58d149bef5cf",
-    "zh:985b1145d724fc1f38369099e4a5087141885740fd6c0b1dbc492171e73c2e49",
+    "h1:Yy3K7R7881H72rQDzG6qjZVkrWA6DGJzfE21TionY7w=",
+    "zh:0313253c78f195973752c4d1f62bfdd345a9c99c1bc7a612a8c1f1e27d51e49e",
+    "zh:108523f3e9ebc93f7d900c51681f6edbd3f3a56b8a62b0afc31d8214892f91e0",
+    "zh:175b9bf2a00bea6ac1c73796ad77b0e00dcbbde166235017c49377d7763861d8",
+    "zh:1c8bf55b8548bbad683cd6d7bdb03e8840a00b2422dc1529ffb9892820657130",
+    "zh:22338f09bae62d5ff646de00182417f992548da534fee7d98c5d0136d4bd5d7a",
+    "zh:92de1107ec43de60612be5f6255616f16a9cf82d88df1af1c0471b81f3a82c16",
     "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
-    "zh:a80b47ae8d1475201c86bd94a5dcb9dd4da5e8b73102a90820b68b66b76d50fd",
-    "zh:d3395be1556210f82199b9166a6b2e677cee9c4b67e96e63f6c3a98325ad7ab0",
-    "zh:db0b869d09657f6f1e4110b56093c5fcdf9dbdd97c020db1e577b239c0adcbce",
-    "zh:ffc72e680370ae7c21f9bd3082c6317730df805c6797427839a6b6b7e9a26a01",
-  ]
-}
-
-provider "registry.terraform.io/hetznercloud/hcloud" {
-  version     = "1.57.0"
-  constraints = "~> 1.45"
-  hashes = [
-    "h1:xpAcuja19Ts7bCpmULKdBw4dEBJhF/eL6AjM4xDBEAI=",
-    "zh:016ecc39328f34f6c0ffa413598f354824f7878c89cd031f123edb4bc8a687a2",
-    "zh:10b362dc0847200c987214b129b5f85e2f7d8ad417261a1d2dd04ab74de15603",
-    "zh:194647d9a61dca4f411f44580316b88a11095d7a99679d445f9b0f2c1ba976c4",
-    "zh:1d8aafe2ce7890696385bb3a0c3286e7ee3020416d337f59935406e4c6f91de6",
-    "zh:594585616210fb232fad4ebda2387ecd3f483931e00eff988fca83add6ce7cfc",
-    "zh:65e50be33ffb85580546f119839e1293591cc6d4db729d809931d0408b6ae408",
-    "zh:7d4ed5bd8c477ec304142e2160203a76a0d09c93d224950bda253172b2571038",
-    "zh:90a70a70a266b78c8216903e711904e6969b3957d182602b5d788602ec9ef323",
-    "zh:abb8e28e96fb8de270995873de980896b7cb53cfc550f02c50eaa42884624ba9",
-    "zh:bbf34dca2de6e105ca7204222162a0402d8e9e9a28e1de5ffbaa2c0d6270a059",
-    "zh:c1a9edb693d632dcb5c3c9ee84c97138e08eadb9354e28592efd581f68ac0385",
-    "zh:dadbf1368fae314fe8dcb99ebefbc78409f3fc0e3808cd92ea573b8eee1cae98",
-    "zh:e713e00ca27348abd18da2eeff861905e84050e3e7e008f14a0c63c70ab2ff84",
+    "zh:9c7bfb7afea330e6d90e1466125a8cba3db1ed4043c5da52f737459c89290a6e",
+    "zh:ba59b374d477e5610674b70f5abfe0408e8f809390347372751384151440d3d0",
+    "zh:bd1c433966002f586d63cb1e3e16326991f238bc6beeb2352be36ec651917b0b",
+    "zh:ca2b4d1d02651c15261fffa4b142e45def9a22c6069353f0f663fd2046e268f8",
+    "zh:d8ed98c748f7a3f1a72277cfee9afe346aca39ab319d17402277852551d8f14a",
+    "zh:ed3d8bc89de5f35f3c5f4802ff7c749fda2e2be267f9af4a850694f099960a72",
+    "zh:f698732a4391c3f4d7079b4aaa52389da2a460cac5eed438ed688f147d603689",
+    "zh:f9f51b17f2978394954e9f6ab9ef293b8e11f1443117294ccf87f7f8212b3439",
   ]
 }

terraform/Taskfile.yml

@@ -0,0 +1,18 @@
+version: 3
+silent: true
+
+vars:
+  BACKEND: ../config/backend.secret.json
+  VARIABLES: ../config/variables.secret.json
+  OUTPUT: ../config/infrastructure.secret.json
+
+tasks:
+  init: terraform init -backend-config={{.BACKEND}}
+  plan: terraform plan -var-file={{.VARIABLES}}
+  destroy: terraform destroy
+  format: terraform fmt -recursive
+  out: terraform output -json > {{.OUTPUT}}
+  apply: 
+    - terraform apply -var-file={{.VARIABLES}}
+    - task: out
+  import: terraform import -var-file={{.VARIABLES}} {{.CLI_ARGS}}

terraform/iam.tf

@@ -0,0 +1,31 @@
+data "aws_s3_bucket" "storage_bucket" {
+  bucket = var.boot_bucket
+}
+
+data "aws_iam_policy_document" "boot" {
+  statement {
+    effect  = "Allow"
+    actions = ["s3:*", "s3-object-lambda:*"]
+    resources = [
+      "${data.aws_s3_bucket.storage_bucket.arn}/${var.boot_key}",
+      "${data.aws_s3_bucket.storage_bucket.arn}/${var.boot_key}/*",
+    ]
+  }
+}
+
+resource "aws_iam_policy" "boot" {
+  name        = "${var.boot_role}Policy"
+  description = "The policy that manages the Gitea Boot."
+
+  policy = data.aws_iam_policy_document.boot.json
+}
+
+module "boot_user" {
+  source  = "terraform-aws-modules/iam/aws//modules/iam-user"
+  version = "5.52.2"
+
+  create_iam_user_login_profile = false
+  name                          = "${var.boot_role}User"
+  password_reset_required       = false
+  policy_arns                   = [aws_iam_policy.boot.arn]
+}

terraform/main.tf

@@ -1,62 +1,43 @@
-resource "hcloud_primary_ip" "public_ip" {
-  name          = "repository-public-ip"
-  datacenter    = local.datacenter
-  type          = "ipv4"
-  assignee_type = "server"
-  auto_delete   = false
+# An elastic IP, so if the reverse proxy is modified, the route tables won't.
+resource "aws_eip" "public" {
+  instance = aws_instance.this.id
+  domain   = "vpc"
 }
 
-resource "hcloud_ssh_key" "ssh_key" {
-  name       = "repository-ssh-key"
-  public_key = file(var.public_ssh_key_path)
+# An instance profile for access via AWS SSM.
+resource "aws_iam_instance_profile" "ssm" {
+  name = "SSMInstanceProfile"
+  role = "AmazonSSMRoleForInstancesQuickSetup"
 }
 
-resource "hcloud_server" "server_instance" {
-  name        = "repository-server"
-  image       = local.server_image
-  server_type = local.server_type
-  datacenter  = local.datacenter
-  ssh_keys    = [hcloud_ssh_key.ssh_key.id]
+# The Gitea instance.
+resource "aws_instance" "this" {
+  # ami           = data.aws_ami.amazon-linux-2.id
+  ami           = "ami-0adec96dc0cdc7bca"
+  instance_type = "t4g.nano"
+  subnet_id     = module.vpc.public_subnets[0]
 
-  public_net {
-    ipv4_enabled = true
-    ipv4         = hcloud_primary_ip.public_ip.id
-    ipv6_enabled = false
+  user_data                   = file("install.sh")
+  user_data_replace_on_change = false
+
+  iam_instance_profile   = aws_iam_instance_profile.ssm.name
+  vpc_security_group_ids = [aws_security_group.public_access.id]
+  
+  metadata_options {
+    http_tokens = "required"
+  }
+
+  root_block_device {
+    volume_type = "gp3"
+    volume_size = 8
+  }
+
+  tags = {
+    Name = "Codebase: Gitea"
   }
 }
 
-resource "hcloud_firewall" "server_firewall" {
-  name = "repository-server-firewall"
-
-  # Allow ICMP.
-  rule {
-    direction  = "in"
-    protocol   = "icmp"
-    source_ips = ["0.0.0.0/0", "::/0"]
-  }
-
-  # Allow all out.
-  rule {
-    direction       = "out"
-    protocol        = "tcp"
-    port            = "any"
-    destination_ips = ["0.0.0.0/0", "::/0"]
-  }
-
-  # Poke holes for applications, and SSH.
-  dynamic "rule" {
-    for_each = ["80", "443", "22", "2222"]
-
-    content {
-      direction  = "in"
-      protocol   = "tcp"
-      port       = rule.value
-      source_ips = ["0.0.0.0/0", "::/0"]
-    }
-  }
-}
-
-resource "hcloud_firewall_attachment" "server_fw_attachment" {
-  firewall_id = hcloud_firewall.server_firewall.id
-  server_ids  = [hcloud_server.server_instance.id]
+resource "aws_ec2_instance_state" "this" {
+  instance_id = aws_instance.this.id
+  state       = "running"
 }

terraform/network.tf

@@ -0,0 +1,66 @@
+locals {
+  # The IP block for the VPC.
+  vpc_cidr = "10.0.0.0/16"
+}
+
+data "aws_availability_zones" "all" {}
+
+# The main VPC.
+module "vpc" {
+  source = "terraform-aws-modules/vpc/aws"
+
+  name = "Main"
+  cidr = local.vpc_cidr
+
+  azs             = [data.aws_availability_zones.all.names[0]]
+  private_subnets = [cidrsubnet(local.vpc_cidr, 8, 0)]
+  public_subnets  = [cidrsubnet(local.vpc_cidr, 8, 4)]
+
+  private_subnet_tags = { SubnetOf = "Main", SubnetType = "Private" }
+  public_subnet_tags  = { SubnetOf = "Main", SubnetType = "Public" }
+
+  map_public_ip_on_launch = true
+  enable_dns_hostnames    = true
+  enable_dns_support      = true
+
+  private_route_table_tags = { TableOf = "Main", TableType = "Public" }
+}
+
+# Only allow HTTP(s) and SSH traffic. Allow full access to internet.
+resource "aws_security_group" "public_access" {
+  vpc_id = module.vpc.vpc_id
+  tags = { GroupOf = "Main", GroupType = "Public" }
+}
+
+resource "aws_vpc_security_group_ingress_rule" "tcp" {
+  for_each = toset(["80", "443", "22", "51821"])
+
+  security_group_id = aws_security_group.public_access.id
+
+  from_port   = each.value
+  to_port     = each.value
+  ip_protocol = "tcp"
+  cidr_ipv4   = "0.0.0.0/0"
+}
+
+resource "aws_vpc_security_group_ingress_rule" "udp" {
+  for_each = toset(["51820", "53"])
+
+  security_group_id = aws_security_group.public_access.id
+
+  from_port   = each.value
+  to_port     = each.value
+  ip_protocol = "udp"
+  cidr_ipv4   = "0.0.0.0/0"
+}
+
+resource "aws_vpc_security_group_egress_rule" "egress" {
+  for_each = toset(["-1"])
+
+  security_group_id = aws_security_group.public_access.id
+
+  from_port   = each.value
+  to_port     = each.value
+  ip_protocol = "-1"
+  cidr_ipv4   = "0.0.0.0/0"
+}

terraform/output.tf

@@ -0,0 +1,33 @@
+output "instance_id" {
+  value       = aws_instance.this.id
+  description = "The instance ID of the Gitea instance."
+}
+
+output "ip_address" {
+  value       = aws_instance.this.private_ip
+  description = "The Gitea IP address."
+}
+
+output "boot_region" {
+  value       = var.aws_region
+  description = "The region to manipulate the codebase repository boot."
+  sensitive   = true
+}
+
+output "boot_id" {
+  value       = module.boot_user.iam_access_key_id
+  description = "The access id to manipulate the codebase repository boot."
+  sensitive   = true
+}
+
+output "boot_secret" {
+  value       = module.boot_user.iam_access_key_secret
+  description = "The access secret to manipulate the codebase repository boot."
+  sensitive   = true
+}
+
+output "full_domain" {
+  value       = "${var.subdomain}.${var.domain}"
+  description = "The domain of the Gitea instance."
+  sensitive   = true
+}

terraform/outputs.tf

@@ -1,11 +0,0 @@
-output "server_ip" {
-  description = "The public address of the server."
-  value = hcloud_server.server_instance.ipv4_address
-  sensitive = false
-}
-
-output "server_fqdn" {
-  description = "The public domain of the server."
-  value = "${local.subdomain}.${local.domain}"
-  sensitive = false
-}

terraform/providers.tf

@@ -1,24 +1,11 @@
 terraform {
-  backend "s3" {
-    skip_credentials_validation = true
-    skip_region_validation      = true
-    skip_requesting_account_id  = true
-  }
-
-  required_providers {
-    hcloud = {
-      source  = "hetznercloud/hcloud"
-      version = "~> 1.45"
-    }
-  }
-}
-
-provider "hcloud" {
-  token = var.hcloud_token
+  # The backend is stored in an S3 bucket.
+  backend "s3" {}
 }
 
+# Access AWS through the IaC roles.
 provider "aws" {
   region     = var.aws_region
-  access_key = var.aws_access_key
-  secret_key = var.aws_secret_key
+  access_key = var.aws_access
+  secret_key = var.aws_secret
 }

terraform/routing.tf

@@ -0,0 +1,13 @@
+# The Route53 DNS zone.
+data "aws_route53_zone" "main" {
+  name = var.domain
+}
+
+# Push all domain traffic through the reverse proxy.
+resource "aws_route53_record" "domain" {
+  zone_id = data.aws_route53_zone.main.zone_id
+  name    = "${var.subdomain}.${data.aws_route53_zone.main.name}"
+  type    = "A"
+  ttl     = "60"
+  records = [aws_eip.public.public_ip]
+}

terraform/variables.tf

@@ -1,39 +1,39 @@
-locals {
-  datacenter = "fsn1-dc14"
-  server_type = "cx22"
-  server_image = "debian-12"
-
-  domain = "maximhutz.com"
-  subdomain = "git"
-}
-
-# ---------------------------------------------------------------------------- #
-
-variable "hcloud_token" {
-  sensitive = true
-  description = "The hCloud token used to access Hetzner resources."
-  type = string
-}
-
-variable "public_ssh_key_path" {
-  description = "The location of the public key used to access the repository server."
-  type = string
-}
-
 variable "aws_region" {
-  description = "The region of the AWS account."
-  type = string
-  sensitive = true
+  type        = string
+  description = "The AWS region things are created in."
 }
 
-variable "aws_access_key" {
-  description = "The access key of the account."
-  type = string
-  sensitive = true
+variable "aws_access" {
+  type        = string
+  description = "The access key to generate the Gitea instance."
 }
 
-variable "aws_secret_key" {
-  description = "The secret key of the account."
-  type = string
-  sensitive = true
+variable "aws_secret" {
+  type        = string
+  description = "The access secret to generate the Gitea instance."
+}
+
+variable "boot_bucket" {
+  type        = string
+  description = "The name of the bucket to store the boot in."
+}
+
+variable "boot_key" {
+  type        = string
+  description = "The path that will hold the boot data."
+}
+
+variable "boot_role" {
+  type        = string
+  description = "The name of the role for boot access."
+}
+
+variable "domain" {
+  type        = string
+  description = "The name of the domain."
+}
+
+variable "subdomain" {
+  type        = string
+  description = "The name of the subdomain."
 }

variables.yml

@@ -1,2 +0,0 @@
-variables:
-  image_name: mvhutz/gitea

vault.yml

@@ -1,70 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-38643539323537353461336432353537646361303835626434666463643836353464633461383533
-3639353663323362666235373161306135396663323962610a376333313966346136616461393130
-31626537333832303433393338336631623635393730353165396166623632363561613538373931
-3936366135623865620a623539306562653738663634363266346335343661333766663763643761
-66393937346664653462393766363563653430353038663439383861336230623861646233373365
-38613461376166633730653463656535316265353361643431303433373631356138363036336665
-62363066313531313064313633353837623338313761636431383832643433646562323531383336
-33343837366635653632316539376162633834363964613138376636666465376234303332643336
-36373539656532323264313431323364656438363562363962393135383733656562666635616265
-66323637306662663464386235646335363432616437336332656162656337326535336335343432
-39356338303430383034383030323737636265353534356130363837373236343262663361313737
-37613839613432376532643962663538633231633837343962373233363830646332623237633930
-37373066613436636639326334363364323834323931653738653837326363323230643161663762
-65353366396666373666383530363861623833393764313865306465303631383664663730643066
-66393736323763323538346131663263306566303334366234633864653561393434393562633539
-32303034303566616632313737303333326365326564313132376364353466376635646131613065
-30646563643239306133313163643032363830653338346335363333316232633164376335373639
-33633837313736633735343835353663323165386238636262373937613731323833323634646531
-30366134643162623666323331636235333635386262323231626261353938623662323936393731
-32383735646631316431633035323933336134356363663732633230636535373238633632636566
-38373136323862366333303737376337366438373231343339383163333661613530366362313738
-38633736373530613032323431366239633236656432633936663939306265316638643163383064
-63326666663865663966333730356435356234343562393630343466393164393466303561316536
-63663630393234623961366639323030313739616235653830356364663731366537343866333831
-33336639653535316632613236343033393930623464343838653436643234343332623539306331
-65663663373333303931326330663664663330353539376530303838643264356164633135626335
-61613739336237666330373138373132346631666366666235346662363839383263323939383138
-39656137343362636432343737616565646163623130623939616336616332616533303261656665
-36306364643064643364666237663630376165303232313763383464313462353831306562666535
-39363930396439633432373330636637313636316365306532333265626433333563343333323064
-36393161383135346535623833396466323332323537316431646134343165353966613331313563
-63326538643038346634323664393565656263323765363334353631616362343835666133383538
-35626334363366323832636366346166373638666132623931633963663336363230316431356666
-31636135303532313537666261393238396666326264323566646230663434323931323030343433
-30356438323032353164333762653630656430306562313036353631663033646666363165623431
-65613736393163363564326362303766363833623665343563326437383436336261346634343535
-65343062373731623439623033323939343137326531316562383962363161666166646138393333
-39353564303738396538613663633430653532643234656366653934333637376635363933313237
-64303762303138613335393938306137346336393966666532313963653635643738306436316230
-64623165656265393938326335656636386437643432383430376138393964643164646638633065
-66396635343435353633636637613933306536306161633238386162633361313639303933653436
-66303365366463353439386336313134316265306663646531376266306662366466653132323233
-37623061663132633539313963396434353734643339393164353066653838346337306464643437
-64623631393235636137666464653431323661326163626639396635666434633939653566343030
-32643364316131336537613237373561653766383834353765633639343964383134313265303632
-35656534666662663732353238333830326531393262633039356332386439653963346661346535
-35376432663663336430653861323266373033383634626337366334363133303430616663353931
-31643134653161646665646561643764336635623333653933643231663863653032666330383537
-65333534323331396262633163343662663966653336616330323365666133653139623761316333
-39616566386365383134393836373134633763373936616365363238323934623734313161396135
-39656135383731623661646361373531643630643137343934393539656334373335636132353130
-31323333336264366435636435653961366165386431313532656631666138336431333366623664
-35316566666366393665333131313434353266356366373930373339636530613530653738633738
-33646531363634343761343438396338656264326163616162306431366432616434316231366465
-63623962383465626437363664653431396630343231356134353331666461613865326164653532
-62653535343830346363636534366366373337653764353431623565626663376461666438653839
-32633031333833613532613465623764386661616363643033613261613632653636643066303162
-39393133646633613464393161313464663233396133633264346431626538663037663732386136
-39653863303030343639353836373731303239666262363432373565326365346566643137653730
-39623663353161626564383166383432656538383935343331646339636333366364646330373435
-62666432336330636135393231356339366639626234656633656531353031623434663034383164
-64316131316432373533363764393934323061393034663761363562313865666635303733613862
-35633363386663316636326333393634353564393935643562663962303564383530343762323466
-64376164383337633436616563303761373533383132346131313465653336366463346166343534
-36316266613037353361306637353065313761656463373632633737663263333265336532323461
-38343566636131663736393266303063333835373438313162383634323239666638303061636639
-37313430383161316365363136353331393764613830653264373835633532303066666166326138
-33373330633737383139613337393739626535626435383364393865393838393636663135653634
-6334