Automate provisioning and deployment of VPS

In order to perform that I had to remove Terraform's =.tfstate= files from the
repository. Terraform does support "backends" for storing the state files, but I
settled for storing it on a separate repo (vps-state).

For now it solves the state management problem:
- it has history of states;
- all state files are GPG encrypted;
- there's no coordination however, but only the CI should perform a deploy in
order to avoid race conditions.

I had to add GPG and SSH keys to sr.ht to achieve that:
- SSH public key to my profile to authorize it to push to vps-state repo;
- SSH private key to the secret builds.sr.ht environment to enable push to the
repository from the pipeline;
- GPG public key to git-crypt to make it possible for the pipeline to unlock the
encrypted content;
- GPG private key to the secret builds.sr.ht environment to enable decrypting
git-crypt content from the pipeline.

In order to avoid divergent environment from local and CI, the ./provision.sh
script is ran through nix-shell.

1 files changed, 7 insertions, 0 deletions

diff --git a/.build.yml b/.build.yml
index c8e51f2..6346e2b 100644
--- a/.build.yml
+++ b/.build.yml
@@ -7,7 +7,14 @@ triggers:
     to: EuAndreh <ci@euandre.org>
 sources:
   - https://git.sr.ht/~euandreh/vps
+  - https://git.sr.ht/~euandreh/vps-state
+secrets:
+  - b1f49116-7515-40ef-857c-42e4519b8472
+  - 7084b7c7-12be-4509-8927-81ba6eeb1fc0
 tasks:
   - tests: |
       cd vps/
       nix-build -A test
+  - deploy: |
+      cd vps/
+      nix-shell --run "bash -c ./provision.sh"