From da00227813b1fbeebae8c90e2122a8b73acb1af9 Mon Sep 17 00:00:00 2001 From: EuAndreh Date: Sun, 26 May 2019 11:51:51 -0300 Subject: Automate provisioning and deployment of VPS In order to perform that I had to remove Terraform's =.tfstate= files from the repository. Terraform does support "backends" for storing the state files, but I settled for storing it on a separate repo (vps-state). For now it solves the state management problem: - it has history of states; - all state files are GPG encrypted; - there's no coordination however, but only the CI should perform a deploy in order to avoid race conditions. I had to add GPG and SSH keys to sr.ht to achieve that: - SSH public key to my profile to authorize it to push to vps-state repo; - SSH private key to the secret builds.sr.ht environment to enable push to the repository from the pipeline; - GPG public key to git-crypt to make it possible for the pipeline to unlock the encrypted content; - GPG private key to the secret builds.sr.ht environment to enable decrypting git-crypt content from the pipeline. In order to avoid divergent environment from local and CI, the ./provision.sh script is ran through nix-shell. --- .build.yml | 7 +++++++ 1 file changed, 7 insertions(+) (limited to '.build.yml') diff --git a/.build.yml b/.build.yml index c8e51f2..6346e2b 100644 --- a/.build.yml +++ b/.build.yml @@ -7,7 +7,14 @@ triggers: to: EuAndreh sources: - https://git.sr.ht/~euandreh/vps + - https://git.sr.ht/~euandreh/vps-state +secrets: + - b1f49116-7515-40ef-857c-42e4519b8472 + - 7084b7c7-12be-4509-8927-81ba6eeb1fc0 tasks: - tests: | cd vps/ nix-build -A test + - deploy: | + cd vps/ + nix-shell --run "bash -c ./provision.sh" -- cgit v1.3