From da00227813b1fbeebae8c90e2122a8b73acb1af9 Mon Sep 17 00:00:00 2001 From: EuAndreh Date: Sun, 26 May 2019 11:51:51 -0300 Subject: Automate provisioning and deployment of VPS In order to perform that I had to remove Terraform's =.tfstate= files from the repository. Terraform does support "backends" for storing the state files, but I settled for storing it on a separate repo (vps-state). For now it solves the state management problem: - it has history of states; - all state files are GPG encrypted; - there's no coordination however, but only the CI should perform a deploy in order to avoid race conditions. I had to add GPG and SSH keys to sr.ht to achieve that: - SSH public key to my profile to authorize it to push to vps-state repo; - SSH private key to the secret builds.sr.ht environment to enable push to the repository from the pipeline; - GPG public key to git-crypt to make it possible for the pipeline to unlock the encrypted content; - GPG private key to the secret builds.sr.ht environment to enable decrypting git-crypt content from the pipeline. In order to avoid divergent environment from local and CI, the ./provision.sh script is ran through nix-shell. --- terraform.tfstate | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'terraform.tfstate') diff --git a/terraform.tfstate b/terraform.tfstate index e3dc257..4fa5ae3 120000 --- a/terraform.tfstate +++ b/terraform.tfstate @@ -1 +1 @@ -secrets/terraform.tfstate \ No newline at end of file +../vps-state/secrets/terraform.tfstate \ No newline at end of file -- cgit v1.3