| Commit message (Collapse) | Author | Files | Lines |
|---|
|
It wasn't trivial to configure: Ansible tried to work on /homeless-shelter :facepalm:
|
|
|
|
|
|
I was letting it be commented during iteration, it shouldn't have been committed
this way.
|
|
|
|
The deployment is not quite working, and I'm unable to test right now:
DigitalOcean is returning 503 for my requests.
As of this commit, I can run =ansible-playbook provider.yml= more than once and
it will actually be idempotent.
Notes:
- SSH fingerprint are now taken from the public key file instead of manually
supplying it in the terraform template using the =digitalocean_ssh_key=
resource;
- use Ansible instead of ad-hoc Bash scripts for provisioning the Droplets
created by Terraform;
- use the =filename.env.extension= to create the concrete files in CI;
- use the =user_data= to add the know SSH key pair to the newly created Droplet;
- add =rotate-ssh-keys.sh= utils;
|
|
ShellCheck offense.
|
|
|
|
|
|
|
|
Split $PLAN_FILE into $PLAN_FILE_NAME and $PLAN_FILE_PATH.
|
|
|
|
|
|
|
|
|
|
Create a new backup entry before running =terraform apply=, which may (or may
not) destroy the current machine.
This shouldn't be an issue for the backup itself, since all of the data should
be stored in a separate Block Storage Volume, but we can take advantage of the
sevices already needing to be taken down in order to perform a full backup of
the data.
|
|
Before possibly tearing down the machine, while all services are stopped (after
the =docker-compose down= command), create a new backup with the current data.
The backup tag should include the commit SHA of the deployment.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Make content of .envrc available to subsequent build jobs.
|
|
|
|
|
|
|
|
|
|
In order to perform that I had to remove Terraform's =.tfstate= files from the
repository. Terraform does support "backends" for storing the state files, but I
settled for storing it on a separate repo (vps-state).
For now it solves the state management problem:
- it has history of states;
- all state files are GPG encrypted;
- there's no coordination however, but only the CI should perform a deploy in
order to avoid race conditions.
I had to add GPG and SSH keys to sr.ht to achieve that:
- SSH public key to my profile to authorize it to push to vps-state repo;
- SSH private key to the secret builds.sr.ht environment to enable push to the
repository from the pipeline;
- GPG public key to git-crypt to make it possible for the pipeline to unlock the
encrypted content;
- GPG private key to the secret builds.sr.ht environment to enable decrypting
git-crypt content from the pipeline.
In order to avoid divergent environment from local and CI, the ./provision.sh
script is ran through nix-shell.
|
|
|
|
|
|
|
