server/terraform.tfstate, branch mainUnnamed repository; edit this file 'description' to name the repository.
http://euandre.org/git/server/atom?h=main2022-03-07T22:12:06ZDelete all old code and configuration to start from scratch with Guix only2022-03-07T22:12:06ZEuAndreheu@euandre.org2022-03-07T22:12:06Zurn:sha1:5bf9572734025ddbe680c0c4978f72df5718ae4b
Delete files related to:
- Terraform
- opt/*
- scripts/deploy
- secrets/*
- git-crypt
- Nix
WIP: Move to Vultr and NixOS2020-08-10T14:30:44ZEuAndreheu@euandre.org2020-08-10T14:30:44Zurn:sha1:18e1dc6cc114e8ea3eedf09e67cd576e879c6326Automate provisioning and deployment of VPS2019-05-26T14:51:51ZEuAndreheu@euandre.org2019-05-26T14:51:51Zurn:sha1:da00227813b1fbeebae8c90e2122a8b73acb1af9
In order to perform that I had to remove Terraform's =.tfstate= files from the
repository. Terraform does support "backends" for storing the state files, but I
settled for storing it on a separate repo (vps-state).
For now it solves the state management problem:
- it has history of states;
- all state files are GPG encrypted;
- there's no coordination however, but only the CI should perform a deploy in
order to avoid race conditions.
I had to add GPG and SSH keys to sr.ht to achieve that:
- SSH public key to my profile to authorize it to push to vps-state repo;
- SSH private key to the secret builds.sr.ht environment to enable push to the
repository from the pipeline;
- GPG public key to git-crypt to make it possible for the pipeline to unlock the
encrypted content;
- GPG private key to the secret builds.sr.ht environment to enable decrypting
git-crypt content from the pipeline.
In order to avoid divergent environment from local and CI, the ./provision.sh
script is ran through nix-shell.
Check-in Terraform .tfstate files using git-crypt2019-05-25T16:17:12ZEuAndreheu@euandre.org2019-05-25T16:17:12Zurn:sha1:afb4f9f97a339a75fee83748d1a3cdae23bd9d27