feat: added cache

.github/workflows/deployment.yml

@@ -0,0 +1,84 @@
+name: Build & Deploy
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  infrastructure:
+    name: Build Infrastructure
+    runs-on: ubuntu-latest
+    env: 
+      RUNNER_TOOL_CACHE: /toolcache
+
+    steps:
+      - name: Checkout to Repository
+        uses: actions/checkout@v2
+
+      - name: Set-up Terraform
+        uses: hashicorp/setup-terraform@v2
+
+      - name: Format Terraform
+        run: terraform fmt -check
+        working-directory: ./terraform
+
+      - name: Initialize Terraform Back-end
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        run: terraform init
+        working-directory: ./terraform
+
+      - name: Terraform Plan
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        run: terraform plan -out=tfplan -no-color
+        working-directory: ./terraform
+
+      - name: Check if there are changes
+        id: check_changes
+        run: |
+          if [ -n "$(terraform show -no-color tfplan | grep -E 'No changes.')" ]; then
+            echo "No changes detected."
+            echo "::set-output name=changes::false"
+          else
+            echo "Changes detected."
+            echo "::set-output name=changes::true"
+          fi
+        working-directory: ./terraform
+
+      - name: Terraform Apply
+        if: ${{ (steps.check_changes.outputs.changes == 'true') && (github.ref == 'refs/heads/main') }}
+        run: terraform apply -auto-approve tfplan
+        working-directory: ./terraform
+  
+  build:
+    name: Deploy Application
+    runs-on: ubuntu-latest
+    env: 
+      RUNNER_TOOL_CACHE: /toolcache
+      
+    steps:
+      - name: Checkout to Repository
+        uses: actions/checkout@v4
+
+      - name: Use Python 3.13
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.13'
+          cache: pip
+      
+      - name: Install Dependencies
+        run: pip install -r requirements.txt
+
+      - name: Lint Playbooks
+        run: ansible-lint
+        working-directory: ./playbooks
+
+      - name: Run Playbook
+        if: ${{ github.ref == 'refs/heads/main' }}
+        run: ansible-playbook deployment.yml
+        working-directory: ./playbooks

.gitignore

@@ -1,45 +1,3 @@
-# ---> Terraform
-# Local .terraform directories
-**/.terraform/*
-
-# .tfstate files
-*.tfstate
-*.tfstate.*
-
-# Crash log files
-crash.log
-crash.*.log
-
-# Exclude all .tfvars files, which are likely to contain sensitive data, such as
-# password, private keys, and other secrets. These should not be part of version 
-# control as they are data points which are potentially sensitive and subject 
-# to change depending on the environment.
-*.tfvars
-*.tfvars.json
-
-# Ignore override files as they are usually used to override resources locally and so
-# are not checked in
-override.tf
-override.tf.json
-*_override.tf
-*_override.tf.json
-
-# Ignore transient lock info files created by terraform apply
-.terraform.tfstate.lock.info
-
-# Include override files you do wish to add to version control using negated pattern
-# !example_override.tf
-
-# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
-# example: *tfplan*
-
-# Ignore CLI configuration files
-.terraformrc
-terraform.rc
-
-# ---> Ansible
-*.retry
-
 # ---> Python
 # Byte-compiled / optimized / DLL files
 __pycache__/
@@ -210,8 +168,60 @@ cython_debug/
 #  option (not recommended) you can uncomment the following to ignore the entire idea folder.
 #.idea/
 
-*secret*
+# ---> Ansible
-.vscode
+*.retry
+
+# ---> Terraform
+# Local .terraform directories
+**/.terraform/*
+
+# .tfstate files
+*.tfstate
+*.tfstate.*
+
+# Crash log files
+crash.log
+crash.*.log
+
+# Exclude all .tfvars files, which are likely to contain sensitive data, such as
+# password, private keys, and other secrets. These should not be part of version 
+# control as they are data points which are potentially sensitive and subject 
+# to change depending on the environment.
+*.tfvars
+*.tfvars.json
+
+# Ignore override files as they are usually used to override resources locally and so
+# are not checked in
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+
+# Ignore transient lock info files created by terraform apply
+.terraform.tfstate.lock.info
+
+# Include override files you do wish to add to version control using negated pattern
+# !example_override.tf
+
+# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
+# example: *tfplan*
+
+# Ignore CLI configuration files
+.terraformrc
+terraform.rc
+
+# Custom ignores.
+boot
+ssh.pem
 .DS_Store
-*.key
+*secret*
-*.out
+*.tfbackend
+*.env
+*.tar.gz
+*.tar.xz
+*.tar
+*.pem
+.venv
+.vscode
+tmp
+node_modules

Taskfile.yml

@@ -1,13 +1,15 @@
 version: 3
 
+includes:
+  tf: { taskfile: terraform, dir: terraform }
+
 tasks:
-  vault: ansible-vault edit vault.yml {{.CLI_ARGS}}
+  deploy: ansible-playbook playbooks/deploy.yml
-  provision: ansible-playbook playbooks/provision.yml {{.CLI_ARGS}}
-  deploy: ansible-playbook playbooks/deploy.yml {{.CLI_ARGS}}
-  restore: ansible-playbook playbooks/restore.yml {{.CLI_ARGS}}
 
   enter:
-    cmd: ssh -i {{.KEY}} root@{{.IP}}
+    cmd: aws ssm start-session --target $INSTANCE_ID
-    vars:
+    env:
-      KEY: { sh: ansible-vault view vault.yml | yq -r ".secret.private_ssh_key_path" }
+      INSTANCE_ID: { sh: jq -r .instance_id.value < config/infrastructure.secret.json }
-      IP: { sh: cat dist/terraform_outputs.yml | jq -r ".server_ip.value" }
+      AWS_REGION: { sh: jq -r .aws_region < config/ansible.secret.json }
+      AWS_ACCESS_KEY_ID: { sh: jq -r .aws_access_key < config/ansible.secret.json }
+      AWS_SECRET_ACCESS_KEY: { sh: jq -r .aws_secret_key < config/ansible.secret.json }

ansible.cfg

@@ -1,13 +0,0 @@
-[defaults]
-callbacks_enabled = profile_tasks
-localhost_warning = False
-vault_password_file = vault.key
-interpreter_python = /usr/bin/python3.11
-
-[inventory]
-inventory_unparsed_warning = False
-
-[ssh_connection]
-ssh_args = -o ControlMaster=auto -o ControlPersist=60s -o ForwardAgent=yes -o IdentityAgent=none
-pipelining = True
-retries = 2

playbooks/deployment.yml

@@ -1,7 +1,7 @@
 - name: Deploy artifact to instance.
   hosts: localhost
   vars_files:
-    - ../config/proxy.json
+    - ../config/ansible.secret.json
     - ../secrets/infrastructure.secret.json
   vars:
     ansible_connection: aws_ssm

playbooks/provision.yml

@@ -1,39 +0,0 @@
-- name: Deploy terraform infrastructure.
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - ../vault.yml
-  tasks:
-    - name: Reconfigure and plan.
-      community.general.terraform:
-        project_path: '../terraform'
-        state: "planned"
-        plan_file: plan.out
-        init_reconfigure: true
-        force_init: true
-        backend_config: "{{ terraform.backend }}"
-        variables: "{{ terraform.variables }}"
-        complex_vars: true
-
-    - name: Apply.
-      community.general.terraform:
-        project_path: '../terraform'
-        state: "present"
-        plan_file: plan.out
-        backend_config: "{{ terraform.backend }}"
-        variables: "{{ terraform.variables }}"
-        complex_vars: true
-      register: terraform_apply
-
-    - name: Create secret directory.
-      ansible.builtin.file:
-        path: ../dist
-        recurse: true
-        mode: "0755"
-        state: directory
-
-    - name: Send outputs to file.
-      ansible.builtin.copy:
-        content: "{{ terraform_apply.outputs }}"
-        dest: ../dist/terraform_outputs.yml
-        mode: '0755'

requirements.txt

@@ -2,9 +2,7 @@ ansible==11.1.0
 ansible-compat==24.10.0
 ansible-core==2.18.1
 ansible-lint==24.12.2
-argcomplete==3.6.2
 attrs==24.3.0
-awscli-local==0.22.0
 black==24.10.0
 boto3==1.35.95
 botocore==1.35.95
@@ -15,14 +13,12 @@ charset-normalizer==3.4.1
 click==8.1.8
 cryptography==44.0.0
 filelock==3.16.1
-go-task-bin==3.44.1
 idna==3.10
 importlib_metadata==8.5.0
 Jinja2==3.1.5
 jmespath==1.0.1
 jsonschema==4.23.0
 jsonschema-specifications==2024.10.1
-localstack-client==2.7
 MarkupSafe==3.0.2
 mypy-extensions==1.0.0
 packaging==24.2
@@ -39,10 +35,7 @@ ruamel.yaml==0.18.10
 s3transfer==0.10.4
 six==1.17.0
 subprocess-tee==0.4.2
-tomlkit==0.13.3
 urllib3==2.3.0
 wcmatch==10.0
-xmltodict==1.0.2
 yamllint==1.35.1
-yq==3.4.3
 zipp==3.21.0

terraform/.terraform.lock.hcl

@@ -1,24 +1,24 @@
 # This file is maintained automatically by "terraform init".
 # Manual edits may be lost in future updates.
 
-provider "registry.terraform.io/hetznercloud/hcloud" {
+provider "registry.terraform.io/hashicorp/aws" {
-  version     = "1.54.0"
+  version = "5.87.0"
-  constraints = "~> 1.45"
   hashes = [
-    "h1:EhA+n+6dzWKlBxyRabPUArCKseyCfAYlYFBB7Yt3TvI=",
+    "h1:IYq3by7O/eJuXzJwOF920z2nZEkw08PkDFdw2xkyhrs=",
-    "zh:1b55c18929e6667fece7b6b462b9b298a09660e0d5173ef22fda780187e739c3",
+    "zh:017f237466875c919330b9e214fb33af14fffbff830d3755e8976d8fa3c963c2",
-    "zh:1fbf44f714a213ca42e131d2cc257791701b1b788061fc720e7293f7853eb874",
+    "zh:0776d1e60aa93c85ecbb01144aed2789c8e180bb0f1c811a0aba17ca7247b26c",
-    "zh:2392d902158dfa6a8ac4dc1f0435662bb2e2cc788464d71bcc66c6326ff2c390",
+    "zh:0dfa5c6cfb3724494fdc73f7d042515e88a20da8968959f48b3ec0b937bd8c8f",
-    "zh:2d5977b3ae947b341db17a0ff71ac9b6b9aa7ff4f1e84bf7cc1e428ccc42b77a",
+    "zh:1707a5ead36a7980cb3f83e8b69a67a14ae725bfc990ddfcc209b59400b57b04",
-    "zh:31c3a9ef4ffc4bd270f0418099a2027a13b3a48f5c585acb04363f89285fd348",
+    "zh:1c71f54fdd6adcbe547d6577dbb843d72a30fef0ab882d0afbeb8a7b348bc442",
-    "zh:34d3a40752fa9f18fac0c9b52ea65b363e3ca3dec040d36c461408d4a54548ee",
+    "zh:3563c850a29790957ec3f4d3ba203bfa2e084ac7319035b3f43b91f818a2c9b4",
-    "zh:61028bbd9f7787b89fc71304765089831e3ba8f9fcde130ab2b79c7f50fa0736",
+    "zh:520bf6cef53785a92226651d5bebacbbf9314bdbc3211d0bf0903bce4e45149d",
-    "zh:68fe4c68e3835aa096ba11e22eec73fbc05dc4dbc01e7e3fbccf9c4b9b78519c",
+    "zh:56f9778575830f6e5c23462c2eccbf2c9afaddb00a69275fcfb33cd1a6d17f4d",
-    "zh:6a32dba16b3bda886682675ff4a1409ceaaff1dcaad35a2d063371d32490be54",
+    "zh:73e381cb0b1e76d471d7b0952f3d2a80350b507d15bda9b7041ea69077e3b5b5",
-    "zh:7754f879a0026f4d2372885f89e4960a74f42e11c914d1ee4e8156c076549cd5",
+    "zh:7da74b48f8fa088be758a92407980400cb4b039a8d9ba3c108907e4055e9ad6f",
-    "zh:8f7d5bde3ec240fb8e7d33f26a4ab46ca26272ea494ce7ea3800f0928bc82b36",
+    "zh:8dacfa9623ba2e0197fe7db6faaaa0820a3b91fe00ba9e5d8a646340522bc8dd",
-    "zh:aa4dd2e088be83be04ba9b8a839f45fed84e154c681599a4fa83ec09d9940f94",
+    "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
-    "zh:bf931451103f9739c888bd980f9d7bdb3172f9247df41efb738667c4cef73840",
+    "zh:9c2ebd21d697e1a611fe201788dc9e1678949a088afc85d4589563bca484d835",
-    "zh:f3873dcaeb70ab58aaa63d79dfbc19e2ec82607291912253f8cb76f46a074e66",
+    "zh:ac5d0bbf36f9a6cedbfb63993f6baf0aabdaf21c8d7fc3b1e69ba8cbf344b5f3",
+    "zh:c2329644179f78a0458b6cf2dd5eaadca4c610fc3577a1b50620544d92df13e8",
   ]
 }

terraform/Taskfile.yml

@@ -0,0 +1,18 @@
+version: 3
+silent: true
+
+vars:
+  BACKEND: ../config/backend.secret.json
+  VARIABLES: ../config/variables.secret.json
+  OUTPUT: ../config/infrastructure.secret.json
+
+tasks:
+  init: terraform init -backend-config={{.BACKEND}}
+  plan: terraform plan -var-file={{.VARIABLES}}
+  destroy: terraform destroy
+  format: terraform fmt -recursive
+  out: terraform output -json > {{.OUTPUT}}
+  apply: 
+    - terraform apply -var-file={{.VARIABLES}}
+    - task: out
+  import: terraform import -var-file={{.VARIABLES}} {{.CLI_ARGS}}

terraform/install.sh

@@ -0,0 +1,30 @@
+#!/bin/sh
+
+rpm --rebuilddb
+amazon-linux-extras install docker ansible2 python3.8 -y
+
+# Make Docker work.
+systemctl enable docker
+systemctl start docker
+
+# Set up the correct version of Python (for Ansible).
+ln -sf /usr/bin/python3.8 /usr/bin/python3
+ln -sf /usr/bin/pip3.8 /usr/bin/pip3
+pip3 install botocore boto3 requests packaging
+python3 -m pip install -U pip
+
+# Add some swap space.
+dd if=/dev/zero of=/swapfile bs=128M count=8
+chmod 600 /swapfile
+mkswap /swapfile
+swapon /swapfile
+
+# Stop SSH (because we have SSM.)
+service sshd stop
+
+# Install Docker Compose.
+curl -L "https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
+chmod +x /usr/local/bin/docker-compose
+
+# ERROR: SSM User not created yet.
+sudo usermod -aG docker ssm-user

terraform/main.tf

@@ -1,90 +1,65 @@
-resource "hcloud_network" "network" {
+data "aws_vpc" "main" {
-  name     = "proxy-network"
+  tags = { Name = "Main" }
-  ip_range = local.network_cidr
 }
 
-resource "hcloud_network_subnet" "subnet" {
+data "aws_subnet" "public" {
-  type         = "cloud"
+  tags = { SubnetOf = "Main", SubnetType = "Public" }
-  network_id   = hcloud_network.network.id
-  network_zone = "eu-central"
-  ip_range     = local.subnet_cidr
 }
 
-/* -------------------------------------------------------------------------- */
+# An instance profile for access via AWS SSM.
-
+data "aws_iam_instance_profile" "ssm" {
-resource "hcloud_primary_ip" "public_ip" {
+  name = "SSMInstanceProfile"
-  name          = "proxy-public-ip"
-  datacenter    = local.datacenter
-  type          = "ipv4"
-  assignee_type = "server"
-  auto_delete   = false
 }
 
-resource "hcloud_ssh_key" "ssh_key" {
+data "aws_security_group" "public" {
-  name       = "proxy-ssh-key"
+  tags = { GroupOf = "Main", GroupType = "Public" }
-  public_key = file(var.public_ssh_key_path)
 }
 
-resource "hcloud_server" "server_instance" {
+data "aws_route_table" "public" {
-  name        = "proxy-server"
+  tags = { TableOf = "Main", TableType = "Public" }
-  image       = local.server_image
-  server_type = local.server_type
-  datacenter  = local.datacenter
-  ssh_keys    = [hcloud_ssh_key.ssh_key.id]
-
-  public_net {
-    ipv4_enabled = true
-    ipv4         = hcloud_primary_ip.public_ip.id
-    ipv6_enabled = false
-  }
-
-  network {
-    network_id = hcloud_network.network.id
-    ip = local.proxy_ip
-    alias_ips = [ ]
-  }
-
-  depends_on = [
-    hcloud_network_subnet.subnet,
-    hcloud_primary_ip.public_ip
-  ]
 }
 
-resource "hcloud_firewall" "server_firewall" {
+# Give the private subnet full access to the internet, too.
-  name = "proxy-server-firewall"
+module "fck-nat" {
+  source = "RaJiska/fck-nat/aws"
 
-  # Allow ICMP.
+  name          = "NatInstance"
-  rule {
+  vpc_id        = data.aws_vpc.main.id
-    direction  = "in"
+  subnet_id     = data.aws_subnet.public.id
-    protocol   = "icmp"
+  instance_type = "t4g.nano"
-    source_ips = ["0.0.0.0/0", "::/0"]
-  }
 
-  # Allow all out.
+  update_route_table = true
-  rule {
+  route_table_id     = data.aws_route_table.public.id
-    direction       = "out"
-    protocol        = "tcp"
-    port            = "any"
-    destination_ips = ["0.0.0.0/0", "::/0"]
-  }
 
-  # Allow ingress for in-network.
+  tags = {
-  rule {
+    Name = "Codebase: Nat"
-    direction  = "in"
-    protocol   = "tcp"
-    source_ips = [local.network_cidr]
-  }
-
-  # Poke holes for SSH.
-  rule {
-    direction  = "in"
-    protocol   = "tcp"
-    port = "22"
-    source_ips = ["0.0.0.0/0", "::/0"]
   }
 }
 
-resource "hcloud_firewall_attachment" "server_fw_attachment" {
+# An elastic IP, so if the reverse proxy is modified, the route tables won't.
-  firewall_id = hcloud_firewall.server_firewall.id
+resource "aws_eip" "public" {
-  server_ids  = [hcloud_server.server_instance.id]
+  instance = aws_instance.proxy.id
+  domain   = "vpc"
+}
+
+# The reverse proxy.
+resource "aws_instance" "proxy" {
+  ami                    = "ami-0adec96dc0cdc7bca"
+  instance_type          = "t4g.nano"
+  subnet_id              = data.aws_subnet.public.id
+  vpc_security_group_ids = [data.aws_security_group.public.id]
+
+  user_data                   = file("install.sh")
+  user_data_replace_on_change = true
+
+  iam_instance_profile = data.aws_iam_instance_profile.ssm.name
+
+  root_block_device {
+    volume_type = "gp3"
+    volume_size = 8
+  }
+
+  tags = {
+    Name = "Codebase: Reverse Proxy"
+  }
 }

terraform/output.tf

@@ -0,0 +1,4 @@
+output "instance_id" {
+  value       = aws_instance.proxy.id
+  description = "The instance ID of the Gitea instance."
+}

terraform/outputs.tf

@@ -1,5 +0,0 @@
-output "proxy_ip" {
-  description = "The public address of the proxy server."
-  value = hcloud_server.server_instance.ipv4_address
-  sensitive = false
-}

terraform/provider.tf

@@ -0,0 +1,13 @@
+terraform {
+  # The backend is stored in an S3 bucket.
+  backend "s3" {
+    bucket = "tsuga-sieboldii"
+    key    = "proxy"
+    region = "us-east-1"
+  }
+}
+
+# Access AWS through the IaC roles.
+provider "aws" {
+  region = "us-east-1"
+}

terraform/providers.tf

@@ -1,18 +0,0 @@
-terraform {
-  backend "s3" {
-    skip_credentials_validation = true
-    skip_region_validation = true
-    skip_requesting_account_id = true
-  }
-
-  required_providers {
-    hcloud = {
-      source  = "hetznercloud/hcloud"
-      version = "~> 1.45"
-    }
-  }
-}
-
-provider "hcloud" {
-  token = var.hcloud_token
-}

terraform/variables.tf

@@ -1,25 +0,0 @@
-locals {
-  datacenter = "fsn1-dc14"
-  server_type = "cx22"
-  server_image = "debian-12"
-
-  domain = "maximhutz.com"
-  subdomain = "git"
-
-  network_cidr = "10.10.0.0/16"
-  subnet_cidr = "10.10.0.0/24"
-  proxy_ip = "10.10.0.10"
-}
-
-# ---------------------------------------------------------------------------- #
-
-variable "hcloud_token" {
-  sensitive = true
-  description = "The hCloud token used to access Hetzner resources."
-  type = string
-}
-
-variable "public_ssh_key_path" {
-  description = "The location of the public key used to access the repository Gitea server."
-  type = string
-}

vault.yml

@@ -1,30 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-34333538313033663865386437623137393162623332646635333033333131323735656639376432
-3464336363356463613262363535306537643930646432650a316261313532613962663436346130
-66613065343261313539613766333066643234356638346433326234303964356330366633656531
-3435373363356264370a366637613463363931643761623130623136336536616139376330396230
-34363664666439333937396537666338363531343965386336646538333464373663393233343334
-61346130323335396331623535386631643061663762333061373635643961376535616631613438
-61623163313136386530313465383764646238663635616666383235353265323036343864653733
-63613961313532626532366363323733333233313034663431303934323736366637366265393237
-36336238343563313136376366356631336636626236666630326436366533333363383664346262
-37353434346362613162613465356537343830313030646665623436646334626435366366623634
-37623232313934336661366364643266376166633238343361343738383331306636353764376439
-32623962636463616336633862376635316364663362356633613839336236316331633531386561
-33313637646161616634663039636337636635383866633961643637313661643338343463363037
-38313636666435666563316233376465333534303732653061623763316237393463623437613430
-64343233396665613032313936623538373031613266613534396530613534653331396437633261
-32313938386431363433306334656539663461613539346330613837356166336134326434336436
-30393665313230373966663263326433363765646164333035633035303831336136376137626334
-33373066343732353064306133653939326535383531633233366332396662363138626162353334
-38383632623238643831393332316135393336653063343330353839393935383736663531393966
-33373430303035396238633037346430333138363038653665343531356439623165353831626161
-30313666326366333636346434373034656432343238353061333166353834383562393532333565
-35306631363330313432353232313234356233326261653938373863356237363961346134346237
-64346237366530323234393732396430323930356635343431323831616264363263653532383537
-63353635643334363131653637636666613037363438326132633833313964656163396638326466
-39656632646639386161643764353362356333656466366263663939633863386330313931336363
-36666631646134376264303565333665653264306338303065653838643133396333613033623366
-61643730333439343365383333623434323535613562363435666138323165383939653832313262
-36393936386566653738626666396363623737613533306466653639656664323032643631313961
-6465