aboutsummaryrefslogtreecommitdiff
path: root/vps.tf (unfollow)
Commit message (Collapse)AuthorFilesLines
2020-11-26Terraform: Add email DNS records (DKIM, DMARC, SPF)EuAndreh1-0/+67
2020-11-18Remove duplicated Vultr provider versionEuAndreh1-1/+0
2020-11-18Remove most Nix filesEuAndreh1-2/+1
2020-11-16Add base Guix configuration and start switching to itEuAndreh1-2/+2
- remove NixOS stateVersion from .envrc; - add guix-reconfigure.sh; - add vps.scm with initial Guix system configuration; - update vps.tf to use the new "base-guix" snapshot. The "base-guix" image doesn't need a password. The "andreh" users has one, but it is configured for not requiring it when running commands as "sudo". The expected minimal steps one has to go through for privilege scalation is via the SSH private key, and accessing the VPS via SSH. Since password login is disabled and root can't login via SSH either, only the private SSH key allows access to the server. After that, the attacker will be able to run commands as root.
2020-08-29Revert to old snapshot idEuAndreh1-2/+1
2020-08-29Build new VPS server from snapshot using bigger machineEuAndreh1-2/+3
I'm using the snapshot here because I don't have any backup system yet, ¯\_(ツ)_/¯ This should be reverted on vps.tf after applying, and I should get down to doing automatic backups.
2020-08-25Enable automatic backup for VPS serverEuAndreh1-0/+1
2020-08-15Use new image with ownership of /etc/nixos/configuration.nix by userEuAndreh1-1/+1
Useful reference: - https://discourse.nixos.org/t/can-i-move-etc-nixos-to-my-dotfiles-and-symlink-it-back-to-etc-nixos/4833/10
2020-08-10Semi working setup: Terraform and LetsEncrypt workingEuAndreh1-33/+2
2020-08-10Interactive Terraform plan -> apply cycleEuAndreh1-4/+4
2020-08-10Use new image with new SSH key and andreh userEuAndreh1-1/+1
2020-08-10WIP: Move to Vultr and NixOSEuAndreh1-68/+38
2020-08-06Remove gpodder.net sync software from the serverEuAndreh1-12/+0
2020-08-05Add gpodder container initial implementationEuAndreh1-0/+12
2020-08-02Remove all wallabag references leftEuAndreh1-12/+0
2020-08-02Use a name from the environment for the names of the host and the volumeEuAndreh1-2/+12
2020-08-02vps.tf: Name VPS volume derived from droplet nameEuAndreh1-1/+1
2020-08-02vps.tf: Add missing host to digitalocean_droplet due to updateEuAndreh1-0/+1
2020-08-02vps.tf: Update to new Terraform syntaxEuAndreh1-21/+21
2019-06-11Comment sections of vps.tfEuAndreh1-0/+8
2019-06-10Output all generated files on ./generated/, refactor .envrc variablesEuAndreh1-1/+1
2019-06-10Provision DNS entries using DigitalOcean instead of DNS registrarEuAndreh1-28/+50
This way we can implement dynamic (provision-time) Floating IP, instead of a hardcoded pre-created Floating IP address. Related changes: - remove =terraform-godaddy= provider, use =digitalocean_record= instead; - create =generated-known-hosts= after provisioning instead of during =setup.sh=: use the =$(terraform output public_floating_ip)= value to make this file dynamic; - remote the =$PINNED_IP= and =$TF_VAR_floating_ip= variables; - add type and descriptions to variable declarations in Terraform recipe.
2019-06-08Format vps.tf (terraform linter offense)EuAndreh1-3/+3
2019-06-08Use terraform-godaddy and Terraform 0.11EuAndreh1-8/+14
The =terraform-godaddy= package supports only Terraform 0.11 as of now. It is not packaged by default by nixpkgs, and the =postInstall= hook is required because Terraform looks for providers usinthe the =terraform-provider-$name= template, which the package doesn't follow. I had to remove the loop on vps.tf since it requires Terraform 0.12. I'll either wait for =terraform-godaddy= to upgrade to 0.12 or try to do it myself if it bothers me enough.
2019-06-08Provision DNS entries with Terraform! :tada:EuAndreh1-0/+22
Before all the DNS entries had to be entered manually on the web UI.
2019-06-05Format vps.tf (linter offense)EuAndreh1-1/+1
2019-06-05Add volume to VPSEuAndreh1-0/+13
Don't destroy everything on deploy. This would destroy the volume too.
2019-06-05Format vps.tf (linter offense)EuAndreh1-1/+1
2019-06-05Use Ansible instead of Bash for provisioningEuAndreh1-5/+11
The deployment is not quite working, and I'm unable to test right now: DigitalOcean is returning 503 for my requests. As of this commit, I can run =ansible-playbook provider.yml= more than once and it will actually be idempotent. Notes: - SSH fingerprint are now taken from the public key file instead of manually supplying it in the terraform template using the =digitalocean_ssh_key= resource; - use Ansible instead of ad-hoc Bash scripts for provisioning the Droplets created by Terraform; - use the =filename.env.extension= to create the concrete files in CI; - use the =user_data= to add the know SSH key pair to the newly created Droplet; - add =rotate-ssh-keys.sh= utils;
2019-05-28Fix vps.tf formatting (linter offense)EuAndreh1-1/+1
2019-05-28Use Floating IP on DropletEuAndreh1-0/+6
2019-05-28Use correct Droplet size slugEuAndreh1-1/+1
Taken from https://developers.digitalocean.com/documentation/v2/#list-all-sizes
2019-05-28Rename ./secrets/id_rsa{.pub} -> ./secrets/vps_box{.pub}EuAndreh1-1/+1
2019-05-26Fix terraform fmt offenseEuAndreh1-1/+1
2019-05-26Automate provisioning and deployment of VPSEuAndreh1-1/+5
In order to perform that I had to remove Terraform's =.tfstate= files from the repository. Terraform does support "backends" for storing the state files, but I settled for storing it on a separate repo (vps-state). For now it solves the state management problem: - it has history of states; - all state files are GPG encrypted; - there's no coordination however, but only the CI should perform a deploy in order to avoid race conditions. I had to add GPG and SSH keys to sr.ht to achieve that: - SSH public key to my profile to authorize it to push to vps-state repo; - SSH private key to the secret builds.sr.ht environment to enable push to the repository from the pipeline; - GPG public key to git-crypt to make it possible for the pipeline to unlock the encrypted content; - GPG private key to the secret builds.sr.ht environment to enable decrypting git-crypt content from the pipeline. In order to avoid divergent environment from local and CI, the ./provision.sh script is ran through nix-shell.
2019-05-25Increase droplet image to 1024mbEuAndreh1-1/+1
2019-05-25Remove provisioning from TerraformEuAndreh1-4/+0
2019-05-25Move provisioning code into provision.shEuAndreh1-8/+1
2019-05-25Add lint checks and a pipeline to check using NixEuAndreh1-1/+0
2019-05-25Format vps.tfEuAndreh1-13/+16
2019-05-25Don't use pub_key and pvt_key as input variablesEuAndreh1-5/+6
Embed SSH keypair directly into git-crypt.
2019-05-25Add simple DigitalOcean droplet skeleton for TerraformEuAndreh1-0/+36
generated by cgit v1.3 (git 2.53.0) at 2026-10-19 21:06:06 +0000