| Commit message (Expand) | Author | Age | Files | Lines |
|---|
| * | Specify email address when rotating keys | EuAndreh | 2019-06-13 | 1 | -0/+0 |
| * | Remove call to =cd= in envrc files | EuAndreh | 2019-06-10 | 1 | -0/+0 |
| * | Output all generated files on ./generated/, refactor .envrc variables | EuAndreh | 2019-06-10 | 2 | -0/+0 |
| * | Re enable $DESTROY_VOLUME toggle | EuAndreh | 2019-06-10 | 1 | -0/+0 |
| * | Import GPG key before provisioning | EuAndreh | 2019-06-10 | 1 | -0/+0 |
| * | Encrypt attached log | EuAndreh | 2019-06-10 | 1 | -0/+0 |
| * | Send logs via email after finishing provision.sh•••The email will be send for both sucessfull and failed runs.
| EuAndreh | 2019-06-10 | 1 | -0/+0 |
| * | Disable $DESTROY_VOLUME operational toggle | EuAndreh | 2019-06-10 | 1 | -0/+0 |
| * | Change SSH port | EuAndreh | 2019-06-10 | 1 | -0/+0 |
| * | Provision DNS entries using DigitalOcean instead of DNS registrar•••This way we can implement dynamic (provision-time) Floating IP, instead of a
hardcoded pre-created Floating IP address.
Related changes:
- remove =terraform-godaddy= provider, use =digitalocean_record= instead;
- create =generated-known-hosts= after provisioning instead of during
=setup.sh=: use the =$(terraform output public_floating_ip)= value to make this
file dynamic;
- remote the =$PINNED_IP= and =$TF_VAR_floating_ip= variables;
- add type and descriptions to variable declarations in Terraform recipe.
| EuAndreh | 2019-06-10 | 1 | -0/+0 |
| * | Change $TLD | EuAndreh | 2019-06-09 | 1 | -0/+0 |
| * | Rotate DNS registrar keys | EuAndreh | 2019-06-09 | 1 | -0/+0 |
| * | Use same NIX_PATH locally and on the CI | EuAndreh | 2019-06-09 | 1 | -0/+0 |
| * | Use terraform-godaddy and Terraform 0.11•••The =terraform-godaddy= package supports only Terraform 0.11 as of now.
It is not packaged by default by nixpkgs, and the =postInstall= hook is required
because Terraform looks for providers usinthe the =terraform-provider-$name=
template, which the package doesn't follow.
I had to remove the loop on vps.tf since it requires Terraform 0.12. I'll either
wait for =terraform-godaddy= to upgrade to 0.12 or try to do it myself if it
bothers me enough.
| EuAndreh | 2019-06-08 | 1 | -0/+0 |
| * | Add credentials for manipulating DNS entries. | EuAndreh | 2019-06-08 | 1 | -0/+0 |
| * | Generate UserKnownHostsFile dynamically instead of when rotating keys•••The previous solution would hardcode the server IP. This way we can change the
server IP address that is hosting everything and keep the SSH keypair.
Previously changing the IP address would require either calling the
=./rotate-ssh-keys.sh= script or manually changing the IP address on the
known-hosts.txt file.
The IP address being duplicated itself was a code smell.
Both SSH keypair and IP address can now be changed independently.
| EuAndreh | 2019-06-08 | 1 | -0/+0 |
| * | Use nextcloud.${TLD} instead of cloud.${TLD} as CNAME for Nextcloud installation | EuAndreh | 2019-06-08 | 1 | -0/+0 |
| * | Add ${DESTROY_VOLUME} operational toggle•••This way I can dynamically control whether to destroy and recreate all the
existing infrastructure entirely from scratch.
The advantages of doing so are:
- test the non-existence of local state on every deployment;
- make sure I can always recreate everything from scratch.
The disadvantages are:
- slower deployment times;
- longer downtime during deployments.
| EuAndreh | 2019-06-06 | 1 | -0/+0 |
| * | Script: rotate SSH keys | EuAndreh | 2019-06-05 | 5 | -0/+0 |
| * | Script: rotate SSH keys | EuAndreh | 2019-06-05 | 5 | -0/+0 |
| * | Script: rotate SSH keys | EuAndreh | 2019-06-05 | 5 | -0/+0 |
| * | Fix git-crypt configuration | EuAndreh | 2019-06-05 | 9 | -0/+0 |
| * | Add ./secrets/borg/meta.txt | EuAndreh | 2019-06-05 | 1 | -0/+2 |
| * | Use specific known keys for connecting with the backup server | EuAndreh | 2019-06-05 | 3 | -0/+2 |
| * | Use non-standard port for SSH | EuAndreh | 2019-06-05 | 1 | -0/+0 |
| * | Use known-hosts.txt with public key from the rotated SSH key pair | EuAndreh | 2019-06-05 | 1 | -0/+1 |
| * | Use Ansible instead of Bash for provisioning•••The deployment is not quite working, and I'm unable to test right now:
DigitalOcean is returning 503 for my requests.
As of this commit, I can run =ansible-playbook provider.yml= more than once and
it will actually be idempotent.
Notes:
- SSH fingerprint are now taken from the public key file instead of manually
supplying it in the terraform template using the =digitalocean_ssh_key=
resource;
- use Ansible instead of ad-hoc Bash scripts for provisioning the Droplets
created by Terraform;
- use the =filename.env.extension= to create the concrete files in CI;
- use the =user_data= to add the know SSH key pair to the newly created Droplet;
- add =rotate-ssh-keys.sh= utils;
| EuAndreh | 2019-06-05 | 12 | -0/+150 |
| * | Use Floating IP on Droplet | EuAndreh | 2019-05-28 | 1 | -0/+0 |
| * | Remove git rev-parse from .envrc | EuAndreh | 2019-05-28 | 1 | -0/+0 |
| * | Rotate secrets | EuAndreh | 2019-05-28 | 1 | -0/+0 |
| * | Split Bash variable declaration from assignment (shellcheck offense) | EuAndreh | 2019-05-28 | 1 | -0/+0 |
| * | Add backup routing before possibly tearing down machine•••Create a new backup entry before running =terraform apply=, which may (or may
not) destroy the current machine.
This shouldn't be an issue for the backup itself, since all of the data should
be stored in a separate Block Storage Volume, but we can take advantage of the
sevices already needing to be taken down in order to perform a full backup of
the data.
| EuAndreh | 2019-05-28 | 1 | -0/+0 |
| * | Add secrets/borg_remote{.pub} SSH keypair | EuAndreh | 2019-05-28 | 2 | -0/+0 |
| * | Rename ./secrets/id_rsa{.pub} -> ./secrets/vps_box{.pub} | EuAndreh | 2019-05-28 | 2 | -0/+0 |
| * | Add variables to properly tag a backup | EuAndreh | 2019-05-27 | 1 | -0/+0 |
| * | Add Nextcloud recipe to docker-compose.yaml | EuAndreh | 2019-05-27 | 1 | -0/+0 |
| * | Use Bash variables for domain names and container ports | EuAndreh | 2019-05-27 | 1 | -0/+0 |
| * | Use more robust Bash cd approach | EuAndreh | 2019-05-26 | 1 | -0/+0 |
| * | Automate provisioning and deployment of VPS•••In order to perform that I had to remove Terraform's =.tfstate= files from the
repository. Terraform does support "backends" for storing the state files, but I
settled for storing it on a separate repo (vps-state).
For now it solves the state management problem:
- it has history of states;
- all state files are GPG encrypted;
- there's no coordination however, but only the CI should perform a deploy in
order to avoid race conditions.
I had to add GPG and SSH keys to sr.ht to achieve that:
- SSH public key to my profile to authorize it to push to vps-state repo;
- SSH private key to the secret builds.sr.ht environment to enable push to the
repository from the pipeline;
- GPG public key to git-crypt to make it possible for the pipeline to unlock the
encrypted content;
- GPG private key to the secret builds.sr.ht environment to enable decrypting
git-crypt content from the pipeline.
In order to avoid divergent environment from local and CI, the ./provision.sh
script is ran through nix-shell.
| EuAndreh | 2019-05-26 | 2 | -0/+0 |
| * | Update .tfstate files | EuAndreh | 2019-05-25 | 2 | -0/+0 |
| * | Restart docker-compose after deployment | EuAndreh | 2019-05-25 | 1 | -0/+0 |
| * | Check-in Terraform .tfstate files using git-crypt | EuAndreh | 2019-05-25 | 2 | -0/+0 |
| * | Don't use pub_key and pvt_key as input variables•••Embed SSH keypair directly into git-crypt.
| EuAndreh | 2019-05-25 | 2 | -0/+0 |
| * | Remove docker-compose.yml from git-crypt | EuAndreh | 2019-05-25 | 2 | -0/+0 |
| * | Add simple DigitalOcean droplet skeleton for Terraform | EuAndreh | 2019-05-25 | 1 | -0/+0 |
| * | Use specific folder for volumes | EuAndreh | 2019-05-25 | 1 | -0/+0 |
| * | Start docker-compose.yml skeleton with Wallabag | EuAndreh | 2019-05-25 | 2 | -0/+0 |
| * | Remove existing NixOps configuration | EuAndreh | 2019-05-25 | 1 | -0/+0 |
| * | Test nixcloud-webservices | EuAndreh | 2019-05-25 | 1 | -0/+0 |
| * | Add simple stub VM definition | EuAndreh | 2019-05-25 | 2 | -0/+0 |
