web/proxy
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Compare commits

merge into: web:feat/actions
Branches Tags
web:main web:feat/use-hetzner web:feat/actions
...
pull from: web:feat/use-hetzner
Branches Tags
web:feat/use-hetzner web:feat/actions web:main

6 Commits
feat/actio ... feat/use-h

Author SHA1 Message Date
Max Hutz
2401368316 feat: nginx proxy manager 2025-10-12 17:32:07 -04:00
Max Hutz
8ca2011d77 feat: add yq to pip requirements 2025-10-08 21:21:02 -04:00
Max Hutz
c42a638a53 feat: provision proxy 2025-10-08 21:18:39 -04:00
Max Hutz
f4e165921c fix: no gitea_, added private key secret 2025-10-08 20:46:13 -04:00
Max Hutz
fae0e13de0 feat: added secrets 2025-10-08 20:43:38 -04:00
Max Hutz
5697e53bc9 chore: move over files from web/git 2025-10-08 20:40:44 -04:00
19 changed files with 545 additions and 230 deletions
Expand all files Collapse all files

100
.gitignore vendored
View File

@@ -1,3 +1,45 @@
# ---> Terraform
# Local .terraform directories
**/.terraform/*
# .tfstate files
*.tfstate
*.tfstate.*
# Crash log files
crash.log
crash.*.log
# Exclude all .tfvars files, which are likely to contain sensitive data, such as
# password, private keys, and other secrets. These should not be part of version
# control as they are data points which are potentially sensitive and subject
# to change depending on the environment.
*.tfvars
*.tfvars.json
# Ignore override files as they are usually used to override resources locally and so
# are not checked in
override.tf
override.tf.json
*_override.tf
*_override.tf.json
# Ignore transient lock info files created by terraform apply
.terraform.tfstate.lock.info
# Include override files you do wish to add to version control using negated pattern
# !example_override.tf
# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
# example: *tfplan*
# Ignore CLI configuration files
.terraformrc
terraform.rc
# ---> Ansible
*.retry
# ---> Python
# Byte-compiled / optimized / DLL files
__pycache__/
@@ -168,60 +210,8 @@ cython_debug/
# option (not recommended) you can uncomment the following to ignore the entire idea folder.
#.idea/
# ---> Ansible
*.retry
# ---> Terraform
# Local .terraform directories
**/.terraform/*
# .tfstate files
*.tfstate
*.tfstate.*
# Crash log files
crash.log
crash.*.log
# Exclude all .tfvars files, which are likely to contain sensitive data, such as
# password, private keys, and other secrets. These should not be part of version
# control as they are data points which are potentially sensitive and subject
# to change depending on the environment.
*.tfvars
*.tfvars.json
# Ignore override files as they are usually used to override resources locally and so
# are not checked in
override.tf
override.tf.json
*_override.tf
*_override.tf.json
# Ignore transient lock info files created by terraform apply
.terraform.tfstate.lock.info
# Include override files you do wish to add to version control using negated pattern
# !example_override.tf
# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
# example: *tfplan*
# Ignore CLI configuration files
.terraformrc
terraform.rc
# Custom ignores.
boot
ssh.pem
.DS_Store
*secret*
*.tfbackend
*.env
*.tar.gz
*.tar.xz
*.tar
*.pem
.venv
.vscode
tmp
node_modules
.DS_Store
*.key
*.out

18
Taskfile.yml
View File

@@ -1,15 +1,13 @@
version: 3
includes:
tf: { taskfile: terraform, dir: terraform }
tasks:
deploy: ansible-playbook playbooks/deploy.yml
vault: ansible-vault edit vault.yml {{.CLI_ARGS}}
provision: ansible-playbook playbooks/provision.yml {{.CLI_ARGS}}
deploy: ansible-playbook playbooks/deploy.yml {{.CLI_ARGS}}
restore: ansible-playbook playbooks/restore.yml {{.CLI_ARGS}}
enter:
cmd: aws ssm start-session --target $INSTANCE_ID
env:
INSTANCE_ID: { sh: jq -r .instance_id.value < config/infrastructure.secret.json }
AWS_REGION: { sh: jq -r .aws_region < config/ansible.secret.json }
AWS_ACCESS_KEY_ID: { sh: jq -r .aws_access_key < config/ansible.secret.json }
AWS_SECRET_ACCESS_KEY: { sh: jq -r .aws_secret_key < config/ansible.secret.json }
cmd: ssh -i {{.KEY}} root@{{.IP}}
vars:
KEY: { sh: ansible-vault view vault.yml | yq -r ".secret.private_ssh_key_path" }
IP: { sh: cat dist/terraform_outputs.yml | jq -r ".proxy_ip.value" }

13
ansible.cfg Normal file
View File

@@ -0,0 +1,13 @@
[defaults]
callbacks_enabled = profile_tasks
localhost_warning = False
vault_password_file = vault.key
interpreter_python = /usr/bin/python3.11
[inventory]
inventory_unparsed_warning = False
[ssh_connection]
ssh_args = -o ControlMaster=auto -o ControlPersist=60s -o ForwardAgent=yes -o IdentityAgent=none
pipelining = True
retries = 2

139
playbooks/deploy.yml Normal file
View File

@@ -0,0 +1,139 @@
- name: Set up real host.
gather_facts: false
hosts: localhost
tags:
- deploy
vars_files:
- ../vault.yml
- ../dist/terraform_outputs.yml
- ../variables.yml
tasks:
- name: Add remote host.
ansible.builtin.add_host:
name: server
ansible_ssh_host: "{{ variables.proxy_host }}"
- name: Set-up NAT.
gather_facts: false
hosts: server
vars_files:
- ../vault.yml
- ../dist/terraform_outputs.yml
tasks:
- name: Install PIP.
ansible.builtin.apt:
name:
- python3-pip
- ifupdown
state: present
update_cache: true
- name: Install needed packages.
ansible.builtin.pip:
name:
- botocore
- boto3
- packaging
state: present
break_system_packages: true
- name: Set-up the network interfaces.
ansible.builtin.blockinfile:
dest: /etc/network/interfaces
marker: "# NAT CONFIG {marker}"
content: |
auto eth0
iface eth0 inet dhcp
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up iptables -t nat -A POSTROUTING -s '{{ network_cidr.value }}' -o eth0 -j MASQUERADE
- name: Install Docker.
gather_facts: true
hosts: server
vars_files:
- ../vault.yml
- ../dist/terraform_outputs.yml
tasks:
- name: Download Docker repository key.
ansible.builtin.apt_key:
url: https://download.docker.com/linux/debian/gpg
state: present
- name: Download Docker repository.
ansible.builtin.apt_repository:
repo: "deb https://download.docker.com/linux/debian {{ ansible_distribution_release }} stable"
state: present
- name: Remove bad packages.
ansible.builtin.apt:
state: absent
package:
- docker.io
- docker-doc
- docker-compose
- podman-docker
- containerd
- runc
- name: Download Docker dependencies.
ansible.builtin.apt:
state: present
package:
- ca-certificates
- curl
- name: Download Docker packages.
ansible.builtin.apt:
state: present
update_cache: true
package:
- docker-ce
- docker-ce-cli
- containerd.io
- docker-buildx-plugin
- docker-compose-plugin
- name: Set-up reverse proxy.
gather_facts: false
hosts: server
vars_files:
- ../vault.yml
- ../dist/terraform_outputs.yml
tasks:
- name: Set-up folders.
ansible.builtin.file:
path: "{{ item }}"
state: directory
recurse: true
loop: [/root/data, /root/letsencrypt]
- name: Set-up manager.
community.docker.docker_container:
name: proxy-manager
image: 'jc21/nginx-proxy-manager:latest'
state: started
restart_policy: unless-stopped
ports: ['80:80', '443:443', '81:81']
labels: { docker-volume-backup.stop-during-backup: "true" }
volumes:
- /root/data:/data
- /root/letsencrypt:/etc/letsencrypt
- name: Run backup.
community.docker.docker_container:
name: proxy-backup
image: offen/docker-volume-backup:v2
state: started
restart_policy: unless-stopped
volumes:
- /root/data:/backup/data:ro
- /root/letsencrypt:/backup/letsencrypt:ro
- /var/run/docker.sock:/var/run/docker.sock:ro
env:
AWS_S3_BUCKET_NAME: "{{ secret.bucket.name }}"
AWS_S3_PATH: "{{ secret.bucket.key }}"
AWS_REGION: "{{ secret.bucket.region }}"
AWS_ACCESS_KEY_ID: "{{ secret.bucket.access_key }}"
AWS_SECRET_ACCESS_KEY: "{{ secret.bucket.secret_key }}"
AWS_ENDPOINT: "{{ secret.bucket.endpoint }}"
BACKUP_CRON_EXPRESSION: "0 0 * * *"

30
playbooks/deployment.yml
View File

@@ -1,30 +0,0 @@
- name: Deploy artifact to instance.
hosts: localhost
vars_files:
- ../config/proxy.json
- ../secrets/infrastructure.secret.json
vars:
ansible_connection: aws_ssm
ansible_python_interpreter: /usr/bin/python3
ansible_aws_ssm_plugin: "{{ ssm_plugin }}"
ansible_aws_ssm_bucket_name: "{{ image_bucket }}"
ansible_aws_ssm_instance_id: "{{ public_instance_id.value }}"
ansible_aws_ssm_region: "{{ aws_region }}"
ansible_aws_ssm_access_key_id: "{{ aws_access_key }}"
ansible_aws_ssm_secret_access_key: "{{ aws_secret_key }}"
tasks:
- name: Run image.
community.docker.docker_container:
name: server
image: "jc21/nginx-proxy-manager:latest"
state: started
recreate: true
restart_policy: always
ports: ["80:80", "443:443", "81:81", "22:22"]
env:
INITIAL_ADMIN_EMAIL: "{{ email }}"
INITIAL_ADMIN_PASSWORD: "{{ password }}"
volumes:
- ./data:/data
- ./letsencrypt:/etc/letsencrypt

59
playbooks/provision.yml Normal file
View File

@@ -0,0 +1,59 @@
- name: Deploy terraform infrastructure.
hosts: localhost
gather_facts: false
vars_files:
- ../vault.yml
tasks:
- name: Reconfigure and plan.
community.general.terraform:
project_path: '../terraform'
state: "planned"
plan_file: plan.out
init_reconfigure: true
force_init: true
backend_config: "{{ terraform.backend }}"
variables: "{{ terraform.variables }}"
complex_vars: true
- name: Apply.
community.general.terraform:
project_path: '../terraform'
state: "present"
plan_file: plan.out
backend_config: "{{ terraform.backend }}"
variables: "{{ terraform.variables }}"
complex_vars: true
register: terraform_apply
- name: Create secret directory.
ansible.builtin.file:
path: ../dist
recurse: true
mode: "0755"
state: directory
- name: Send outputs to file.
ansible.builtin.copy:
content: "{{ terraform_apply.outputs }}"
dest: ../dist/terraform_outputs.yml
mode: '0755'
- name: Update SSH config.
hosts: localhost
gather_facts: false
tags: hosts
vars_files:
- ../vault.yml
- ../dist/terraform_outputs.yml
- ../variables.yml
tasks:
- name: Add proxy host.
community.general.ssh_config:
host: "{{ variables.proxy_host }}"
hostname: "{{ proxy_ip.value }}"
remote_user: root
forward_agent: true
user: user
port: 22
identity_file: "{{ secret.private_ssh_key_path }}"

11
requirements.txt
View File

@@ -2,7 +2,10 @@ ansible==11.1.0
ansible-compat==24.10.0
ansible-core==2.18.1
ansible-lint==24.12.2
argcomplete==3.6.2
attrs==24.3.0
awscli-local==0.22.0
bcrypt==5.0.0
black==24.10.0
boto3==1.35.95
botocore==1.35.95
@@ -13,18 +16,23 @@ charset-normalizer==3.4.1
click==8.1.8
cryptography==44.0.0
filelock==3.16.1
go-task-bin==3.44.1
idna==3.10
importlib_metadata==8.5.0
invoke==2.2.1
Jinja2==3.1.5
jmespath==1.0.1
jsonschema==4.23.0
jsonschema-specifications==2024.10.1
localstack-client==2.7
MarkupSafe==3.0.2
mypy-extensions==1.0.0
packaging==24.2
paramiko==4.0.0
pathspec==0.12.1
platformdirs==4.3.6
pycparser==2.22
PyNaCl==1.6.0
python-dateutil==2.9.0.post0
PyYAML==6.0.2
referencing==0.35.1
@@ -35,7 +43,10 @@ ruamel.yaml==0.18.10
s3transfer==0.10.4
six==1.17.0
subprocess-tee==0.4.2
tomlkit==0.13.3
urllib3==2.3.0
wcmatch==10.0
xmltodict==1.0.2
yamllint==1.35.1
yq==3.4.3
zipp==3.21.0

54
terraform/.terraform.lock.hcl generated
View File

@@ -2,23 +2,45 @@
# Manual edits may be lost in future updates.
provider "registry.terraform.io/hashicorp/aws" {
version = "5.87.0"
version = "6.16.0"
hashes = [
"h1:IYq3by7O/eJuXzJwOF920z2nZEkw08PkDFdw2xkyhrs=",
"zh:017f237466875c919330b9e214fb33af14fffbff830d3755e8976d8fa3c963c2",
"zh:0776d1e60aa93c85ecbb01144aed2789c8e180bb0f1c811a0aba17ca7247b26c",
"zh:0dfa5c6cfb3724494fdc73f7d042515e88a20da8968959f48b3ec0b937bd8c8f",
"zh:1707a5ead36a7980cb3f83e8b69a67a14ae725bfc990ddfcc209b59400b57b04",
"zh:1c71f54fdd6adcbe547d6577dbb843d72a30fef0ab882d0afbeb8a7b348bc442",
"zh:3563c850a29790957ec3f4d3ba203bfa2e084ac7319035b3f43b91f818a2c9b4",
"zh:520bf6cef53785a92226651d5bebacbbf9314bdbc3211d0bf0903bce4e45149d",
"zh:56f9778575830f6e5c23462c2eccbf2c9afaddb00a69275fcfb33cd1a6d17f4d",
"zh:73e381cb0b1e76d471d7b0952f3d2a80350b507d15bda9b7041ea69077e3b5b5",
"zh:7da74b48f8fa088be758a92407980400cb4b039a8d9ba3c108907e4055e9ad6f",
"zh:8dacfa9623ba2e0197fe7db6faaaa0820a3b91fe00ba9e5d8a646340522bc8dd",
"h1:eBjQq1U3AZ+mkEgE6cC8z6Qw4DIV23tNmM8tCcuqXuk=",
"zh:11b5c11fc47aa7537d3acfb3156c9206ce465c2c0db4478914d1ba9493a27f38",
"zh:1de5c4ef8096ab6a4fe8e528c5a1d772a57de74ef4de98996071987d0d6a7696",
"zh:1eaaaa02503e34e57494831ea32b3327482857b01011b40753ec37c502719ee0",
"zh:367159ac72b344802e72631505894b1e7c04211f59d17c137cc9528acfb3b940",
"zh:449bb91e861d16ce80aabe148b40fa20ee4250c934cf467f6c21cf2206be1b5f",
"zh:45b4757e15a9887bf1d6dce07cbbbff365399759bb920456cf30cae47f0b0170",
"zh:4d2824050f8f2d3916a3363e0eeeab6c2c5a0912323029c4c7dc6e93ff3cfbc1",
"zh:6f363f811d20d7bd3e558d6da2cff0506c78ccea5956f919e531b22fdc7300c8",
"zh:7ab0990fc172a1343e4af6d7540be43adba989ee1b422b9d54c3369247155cea",
"zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
"zh:9c2ebd21d697e1a611fe201788dc9e1678949a088afc85d4589563bca484d835",
"zh:ac5d0bbf36f9a6cedbfb63993f6baf0aabdaf21c8d7fc3b1e69ba8cbf344b5f3",
"zh:c2329644179f78a0458b6cf2dd5eaadca4c610fc3577a1b50620544d92df13e8",
"zh:9eaae66cc57aa07a392eb9cb3fc115a5f446ffe9f51a7f45ffaefc7a64c17b31",
"zh:aee7dbba84823ed9ca93afb0579c78605588f9355e23ec1aafa22ac4a77c45c3",
"zh:be18792d2a52bbc06e6d21dc69c7ec7134e7aaf9e8bca5fd48d2edc8c1f9085e",
"zh:d2fb28162a6ed080fefe1d16b20be86652568e930aa777f186ecfcac66af6c43",
"zh:e1ffb80f46b64c26742417abe454af9c0d3920a8636698574c0a558e66cad535",
]
}
provider "registry.terraform.io/hetznercloud/hcloud" {
version = "1.54.0"
constraints = "~> 1.45"
hashes = [
"h1:EhA+n+6dzWKlBxyRabPUArCKseyCfAYlYFBB7Yt3TvI=",
"zh:1b55c18929e6667fece7b6b462b9b298a09660e0d5173ef22fda780187e739c3",
"zh:1fbf44f714a213ca42e131d2cc257791701b1b788061fc720e7293f7853eb874",
"zh:2392d902158dfa6a8ac4dc1f0435662bb2e2cc788464d71bcc66c6326ff2c390",
"zh:2d5977b3ae947b341db17a0ff71ac9b6b9aa7ff4f1e84bf7cc1e428ccc42b77a",
"zh:31c3a9ef4ffc4bd270f0418099a2027a13b3a48f5c585acb04363f89285fd348",
"zh:34d3a40752fa9f18fac0c9b52ea65b363e3ca3dec040d36c461408d4a54548ee",
"zh:61028bbd9f7787b89fc71304765089831e3ba8f9fcde130ab2b79c7f50fa0736",
"zh:68fe4c68e3835aa096ba11e22eec73fbc05dc4dbc01e7e3fbccf9c4b9b78519c",
"zh:6a32dba16b3bda886682675ff4a1409ceaaff1dcaad35a2d063371d32490be54",
"zh:7754f879a0026f4d2372885f89e4960a74f42e11c914d1ee4e8156c076549cd5",
"zh:8f7d5bde3ec240fb8e7d33f26a4ab46ca26272ea494ce7ea3800f0928bc82b36",
"zh:aa4dd2e088be83be04ba9b8a839f45fed84e154c681599a4fa83ec09d9940f94",
"zh:bf931451103f9739c888bd980f9d7bdb3172f9247df41efb738667c4cef73840",
"zh:f3873dcaeb70ab58aaa63d79dfbc19e2ec82607291912253f8cb76f46a074e66",
]
}

18
terraform/Taskfile.yml
View File

@@ -1,18 +0,0 @@
version: 3
silent: true
vars:
BACKEND: ../config/backend.secret.json
VARIABLES: ../config/variables.secret.json
OUTPUT: ../config/infrastructure.secret.json
tasks:
init: terraform init -backend-config={{.BACKEND}}
plan: terraform plan -var-file={{.VARIABLES}}
destroy: terraform destroy
format: terraform fmt -recursive
out: terraform output -json > {{.OUTPUT}}
apply:
- terraform apply -var-file={{.VARIABLES}}
- task: out
import: terraform import -var-file={{.VARIABLES}} {{.CLI_ARGS}}

30
terraform/install.sh
View File

@@ -1,30 +0,0 @@
#!/bin/sh
rpm --rebuilddb
amazon-linux-extras install docker ansible2 python3.8 -y
# Make Docker work.
systemctl enable docker
systemctl start docker
# Set up the correct version of Python (for Ansible).
ln -sf /usr/bin/python3.8 /usr/bin/python3
ln -sf /usr/bin/pip3.8 /usr/bin/pip3
pip3 install botocore boto3 requests packaging
python3 -m pip install -U pip
# Add some swap space.
dd if=/dev/zero of=/swapfile bs=128M count=8
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile
# Stop SSH (because we have SSM.)
service sshd stop
# Install Docker Compose.
curl -L "https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
chmod +x /usr/local/bin/docker-compose
# ERROR: SSM User not created yet.
sudo usermod -aG docker ssm-user

131
terraform/main.tf
View File

@@ -1,65 +1,100 @@
data "aws_vpc" "main" {
tags = { Name = "Main" }
resource "hcloud_network" "network" {
name = "proxy-network"
ip_range = local.network_cidr
}
data "aws_subnet" "public" {
tags = { SubnetOf = "Main", SubnetType = "Public" }
resource "hcloud_network_subnet" "subnet" {
type = "cloud"
network_id = hcloud_network.network.id
network_zone = "eu-central"
ip_range = local.subnet_cidr
}
# An instance profile for access via AWS SSM.
data "aws_iam_instance_profile" "ssm" {
name = "SSMInstanceProfile"
resource "hcloud_network_route" "privNet" {
network_id = hcloud_network.network.id
destination = "0.0.0.0/0"
gateway = local.proxy_ip
}
data "aws_security_group" "public" {
tags = { GroupOf = "Main", GroupType = "Public" }
/* -------------------------------------------------------------------------- */
resource "hcloud_primary_ip" "public_ip" {
name = "proxy-public-ip"
datacenter = local.datacenter
type = "ipv4"
assignee_type = "server"
auto_delete = false
}
data "aws_route_table" "public" {
tags = { TableOf = "Main", TableType = "Public" }
resource "hcloud_ssh_key" "ssh_key" {
name = "proxy-ssh-key"
public_key = file(var.public_ssh_key_path)
}
# Give the private subnet full access to the internet, too.
module "fck-nat" {
source = "RaJiska/fck-nat/aws"
resource "hcloud_server" "server_instance" {
name = "proxy-server"
image = local.server_image
server_type = local.server_type
datacenter = local.datacenter
ssh_keys = [hcloud_ssh_key.ssh_key.id]
name = "NatInstance"
vpc_id = data.aws_vpc.main.id
subnet_id = data.aws_subnet.public.id
instance_type = "t4g.nano"
public_net {
ipv4_enabled = true
ipv4 = hcloud_primary_ip.public_ip.id
ipv6_enabled = false
}
update_route_table = true
route_table_id = data.aws_route_table.public.id
network {
network_id = hcloud_network.network.id
ip = local.proxy_ip
alias_ips = [ ]
}
tags = {
Name = "Codebase: Nat"
depends_on = [
hcloud_network_subnet.subnet,
hcloud_primary_ip.public_ip
]
}
resource "hcloud_firewall" "server_firewall" {
name = "proxy-server-firewall"
# Allow ICMP.
rule {
direction = "in"
protocol = "icmp"
source_ips = ["0.0.0.0/0", "::/0"]
}
# Allow all out.
rule {
direction = "out"
protocol = "tcp"
port = "any"
destination_ips = ["0.0.0.0/0", "::/0"]
}
# Allow ingress for in-network.
rule {
direction = "in"
protocol = "tcp"
source_ips = [local.network_cidr]
}
# Poke holes for applications, and SSH.
dynamic "rule" {
for_each = ["80", "443", "22", "81"]
content {
direction = "in"
protocol = "tcp"
port = rule.value
source_ips = ["0.0.0.0/0", "::/0"]
}
}
}
# An elastic IP, so if the reverse proxy is modified, the route tables won't.
resource "aws_eip" "public" {
instance = aws_instance.proxy.id
domain = "vpc"
}
# The reverse proxy.
resource "aws_instance" "proxy" {
ami = "ami-0adec96dc0cdc7bca"
instance_type = "t4g.nano"
subnet_id = data.aws_subnet.public.id
vpc_security_group_ids = [data.aws_security_group.public.id]
user_data = file("install.sh")
user_data_replace_on_change = true
iam_instance_profile = data.aws_iam_instance_profile.ssm.name
root_block_device {
volume_type = "gp3"
volume_size = 8
}
tags = {
Name = "Codebase: Reverse Proxy"
}
resource "hcloud_firewall_attachment" "server_fw_attachment" {
firewall_id = hcloud_firewall.server_firewall.id
server_ids = [hcloud_server.server_instance.id]
}

4
terraform/output.tf
View File

@@ -1,4 +0,0 @@
output "instance_id" {
value = aws_instance.proxy.id
description = "The instance ID of the Gitea instance."
}

11
terraform/outputs.tf Normal file
View File

@@ -0,0 +1,11 @@
output "proxy_ip" {
description = "The public address of the proxy server."
value = hcloud_server.server_instance.ipv4_address
sensitive = false
}
output "network_cidr" {
description = "The CIDR of the private network."
value = local.network_cidr
sensitive = false
}

11
terraform/provider.tf
View File

@@ -1,11 +0,0 @@
terraform {
# The backend is stored in an S3 bucket.
backend "s3" {}
}
# Access AWS through the IaC roles.
provider "aws" {
region = var.aws_region
access_key = var.aws_access
secret_key = var.aws_secret
}

24
terraform/providers.tf Normal file
View File

@@ -0,0 +1,24 @@
terraform {
backend "s3" {
skip_credentials_validation = true
skip_region_validation = true
skip_requesting_account_id = true
}
required_providers {
hcloud = {
source = "hetznercloud/hcloud"
version = "~> 1.45"
}
}
}
provider "hcloud" {
token = var.hcloud_token
}
provider "aws" {
region = var.aws_region
access_key = var.aws_access_key
secret_key = var.aws_secret_key
}

14
terraform/routing.tf Normal file
View File

@@ -0,0 +1,14 @@
# The Route53 DNS zone.
data "aws_route53_zone" "main" {
name = local.domain
}
# Push all domain traffic through the reverse proxy.
resource "aws_route53_record" "domain" {
zone_id = data.aws_route53_zone.main.zone_id
name = "*.${data.aws_route53_zone.main.name}"
type = "A"
ttl = "60"
records = [hcloud_primary_ip.public_ip.ip_address]
}

38
terraform/variables.tf
View File

@@ -1,14 +1,42 @@
locals {
datacenter = "fsn1-dc14"
server_type = "cx22"
server_image = "debian-12"
domain = "maximhutz.com"
network_cidr = "10.10.0.0/16"
subnet_cidr = "10.10.0.0/24"
proxy_ip = "10.10.0.10"
}
# ---------------------------------------------------------------------------- #
variable "hcloud_token" {
sensitive = true
description = "The hCloud token used to access Hetzner resources."
type = string
}
variable "public_ssh_key_path" {
description = "The location of the public key used to access the repository Gitea server."
type = string
}
variable "aws_region" {
description = "The region of the AWS account."
type = string
description = "The AWS region things are created in."
sensitive = true
}
variable "aws_access" {
variable "aws_access_key" {
description = "The access key of the account."
type = string
description = "The access key to generate the Gitea instance."
sensitive = true
}
variable "aws_secret" {
variable "aws_secret_key" {
description = "The secret key of the account."
type = string
description = "The access secret to generate the Gitea instance."
sensitive = true
}

2
variables.yml Normal file
View File

@@ -0,0 +1,2 @@
variables:
proxy_host: proxy

62
vault.yml Normal file
View File

@@ -0,0 +1,62 @@
$ANSIBLE_VAULT;1.1;AES256
33396339353933616166653538396231653965383432663433313161393539383937303635393565
6262633463303635663231313032613236326336316233380a373536633834303438313236366438
61313430323738393534343262653064663437663734393633643062363064366639393565353764
3930323766656531630a666362306538323930656330386261633264636130386134643965616534
32633036323661336238633464316637643138623766333832666331363831316235616161656231
34663333326531306232326136383033393664373130353135396633346462353865316461616334
66633237366163303936653137323939363464383065373566613163656635333636653339306237
35356163623537376637386262633163623538613261323566656566323938336264313636383936
66323839343336666638303830396163306666633461343934356333643230326433363761636231
65343436353463396536636663366362653065353163303636306164366638353964363930333562
30323661323935643065653062393265386536656134356632323764656634316562363734323165
35656465343763336636626461343436366363306530653434303637623737613034626362303931
31303736623361616363643661646335383039356531626239353830646566333135653264303239
64303163666166386336646434333237653433656565353032616634313261336535633365373961
38633936363266303264663033376662383632616362363939326565656535386231316237623761
32613830383036626534623631313961323534303931356637326461633739623430353734373530
35376663326130393534373735653562373234396437653238323630333733313365636330393835
32613230303035656530346238623034336236356630653236353362633131663237386330303933
30376465646261663065663737613639393361633466316538656166396432663432656430653438
66396439323339646662306436643062346339373463343031643563366531356432336562333537
31326337613739343333326136336439306563333433613736383762656332313632346335613836
39396330373030373661373565373361626333333631386433316566646661376263633866303530
63626462366437383539666434313866373838333863633934313235363265626132646535303638
39343966613234326661313539386232646230363961353537613931633839303635623866316534
61623639613336633037343135663363343664633233656466326132363262336235316237333561
38613038386439363865636665333939346662383235393662303335633866633664386264386432
30303636346533633234313833303339633134393131396232633734626130393137363361393764
65366234626532633066656131653439333639353162363931393035343462646261383238636230
38363330313137366234306334353264343232333035646236616537313136313332363966653435
33663538393064373430383030653331623039363635643138363333373532656432326338346336
65626363616430636464316334303664353633363364313136636665323263373461663339323166
30636438626265316433363861363763623263303533656632373961333966613561373436303361
66323732353230343238353438386563393264333265363864383861366233393830623863376664
65353930303338323533326337616636323433646235346161613437643964396231656231623935
34663365343131373434343766366132656534343732623639663138663863383337303830636638
64323537656165363061346265636266333838633163663963643564616234373930366632373762
65393936383538643331366232333637353133326266383933393561383539393562353366366435
31356163386633623039373830336432356361663632356233653865656531663162383135333533
64306331376461393566353433633238316637366538613635383862656262663461303335663831
63623839373462336531316462373138323136383463666561383661633761613832623633663664
65663232666537663433653662613363623336346161363832643662373666383436396634616462
35656230383739326537323737636266303563653232623634643036613765646335303137303733
65616339333366653835383331643332376635613837663763616235663838663762386130663732
39376433303633383463623139366237666230333137383838343432626130386161653936353662
63323661376538356339626431333036633538633065643665323832303431393166383163633737
36323464616138616633326464633238303861643235303431336137666432313261616536663039
61306231663661396265333438376164333561616661386538313462366466623537393263643464
32326439343863613464313365613630383133353262343732323339616664383261343364643566
65363234383062356131343439383266343733656661653063366139303766356264626262613532
32633135626633656166376639303738303435643662313439663330643530393965663363616166
38653438306361623134666631653230306136336438366662303264666531633539343635393130
37346539363533386465623936326232613062633336633262353235303762623530653333623639
62376131646164343339656636353332303263636531626230313766636661636233366136316638
35383436636266636237333231613930366466346432356134613232306163653839346637356562
62633931303432616436396131666434333238363563353465323236336162643339376434393736
36663735313866616633666638363832656234363835383961323561313662643438316666646535
37626266353932373063633963616431666535306531393037616431653061323436316636653962
30393537363232666634343663346435616362663731653834613831303531376566303038376436
38303934633233396361623534356631383536363461356137323865373434363437653330383538
38646161613439346232326434646136663861383963336363643931303830613237353363306663
6133