diff --git a/GNUmakefile b/GNUmakefile index de3aa4a..151e834 100644 --- a/GNUmakefile +++ b/GNUmakefile @@ -11,9 +11,13 @@ all: up rebuild: down up .PHONY: up -up: +up: plan $(TF) apply -auto-approve +.PHONY: plan +plan: + $(TF) plan + .PHONY: down down: $(TF) destroy -auto-approve diff --git a/dns-mitchty.net.tf b/dns-mitchty.net.tf new file mode 100644 index 0000000..c26554c --- /dev/null +++ b/dns-mitchty.net.tf @@ -0,0 +1,204 @@ +variable "cloudflare_mitchty_net_zoneid" { + type = string +} + +resource "cloudflare_record" "ns1_mitchty_net" { + zone_id = var.cloudflare_mitchty_net_zoneid + name = "@" + value = "mitch.ns.cloudflare.com" + type = "NS" +} + +resource "cloudflare_record" "ns2_mitchty_net" { + zone_id = var.cloudflare_mitchty_net_zoneid + name = "@" + value = "tegan.ns.cloudflare.com" + type = "NS" +} + +resource "cloudflare_record" "root_mitchty_net" { + depends_on = [ + linode_instance.prod, + cloudflare_record.ns1_mitchty_net, + cloudflare_record.ns2_mitchty_net ] + zone_id = var.cloudflare_mitchty_net_zoneid + name = "@" + value = linode_instance.prod.ip_address + type = "A" + ttl = local.dns_ttl +} + +resource "cloudflare_record" "splat_mitchty_net" { + depends_on = [ + linode_instance.prod, + cloudflare_record.ns1_mitchty_net, + cloudflare_record.ns2_mitchty_net ] + zone_id = var.cloudflare_mitchty_net_zoneid + name = "*" + value = linode_instance.prod.ip_address + type = "A" + ttl = local.dns_ttl +} + +# resource "cloudflare_record" "root6_mitchty_net" { +# depends_on = [ +# linode_instance.prod, +# cloudflare_record.ns1_mitchty_net, +# cloudflare_record.ns2_mitchty_net ] +# zone_id = var.cloudflare_mitchty_net_zoneid +# name = "@" +# value = local.ipv6 +# type = "AAAA" +# ttl = local.dns_ttl +# } + +# resource "cloudflare_record" "splat6_mitchty_net" { +# depends_on = [ +# linode_instance.prod, +# cloudflare_record.ns1_mitchty_net, +# cloudflare_record.ns2_mitchty_net ] +# zone_id = var.cloudflare_mitchty_net_zoneid +# name = "*" +# value = local.ipv6 +# type = "AAAA" +# ttl = local.dns_ttl +# proxied = true +# } + + +resource "cloudflare_record" "home_mitchty_net" { + depends_on = [ + cloudflare_record.root_mitchty_net, + cloudflare_record.splat_mitchty_net ] + zone_id = var.cloudflare_mitchty_net_zoneid + name = "home" + value = "24.118.92.50" + type = "A" + ttl = local.dns_ttl +} + +resource "cloudflare_record" "www_mitchty_net" { + depends_on = [ + cloudflare_record.root_mitchty_net, + cloudflare_record.splat_mitchty_net ] + zone_id = var.cloudflare_mitchty_net_zoneid + name = "www" + value = "mitchty.net" + type = "CNAME" + ttl = local.dns_ttl +} + +resource "cloudflare_record" "git_mitchty_net" { + depends_on = [ + cloudflare_record.root_mitchty_net, + cloudflare_record.splat_mitchty_net ] + zone_id = var.cloudflare_mitchty_net_zoneid + name = "git" + value = "mitchty.net" + type = "CNAME" + ttl = local.dns_ttl +} + +# MX record setup for fastmail dkim/spf on root and all subdomains +resource "cloudflare_record" "mx_cname_1_mitchty_net" { + depends_on = [ + cloudflare_record.root_mitchty_net, + cloudflare_record.splat_mitchty_net ] + zone_id = var.cloudflare_mitchty_net_zoneid + name = "fm1._domainkey" + value = "fm1.mitchty.net.dkim.fmhosted.net" + type = "CNAME" + ttl = local.dns_ttl +} + +resource "cloudflare_record" "mx_cname_2_mitchty_net" { + depends_on = [ + cloudflare_record.root_mitchty_net, + cloudflare_record.splat_mitchty_net ] + zone_id = var.cloudflare_mitchty_net_zoneid + name = "fm2._domainkey" + value = "fm2.mitchty.net.dkim.fmhosted.net" + type = "CNAME" + ttl = local.dns_ttl +} + +resource "cloudflare_record" "mx_cname_3_mitchty_net" { + depends_on = [ + cloudflare_record.root_mitchty_net, + cloudflare_record.splat_mitchty_net ] + zone_id = var.cloudflare_mitchty_net_zoneid + name = "fm3._domainkey" + value = "fm3.mitchty.net.dkim.fmhosted.net" + type = "CNAME" + ttl = local.dns_ttl +} + +resource "cloudflare_record" "mx_10_root_mitchty_net" { + depends_on = [ + cloudflare_record.root_mitchty_net, + cloudflare_record.splat_mitchty_net ] + zone_id = var.cloudflare_mitchty_net_zoneid + name = "@" + value = "in1-smtp.messagingengine.com" + type = "MX" + priority = "10" + ttl = local.dns_ttl +} + +resource "cloudflare_record" "mx_20_root_mitchty_net" { + depends_on = [ + cloudflare_record.root_mitchty_net, + cloudflare_record.splat_mitchty_net ] + zone_id = var.cloudflare_mitchty_net_zoneid + name = "@" + value = "in2-smtp.messagingengine.com" + type = "MX" + priority = "20" + ttl = local.dns_ttl +} + +resource "cloudflare_record" "mx_10_splat_mitchty_net" { + depends_on = [ + cloudflare_record.root_mitchty_net, + cloudflare_record.splat_mitchty_net ] + zone_id = var.cloudflare_mitchty_net_zoneid + name = "*" + value = "in1-smtp.messagingengine.com" + type = "MX" + priority = "10" + ttl = local.dns_ttl +} + +resource "cloudflare_record" "mx_20_splat_mitchty_net" { + depends_on = [ + cloudflare_record.root_mitchty_net, + cloudflare_record.splat_mitchty_net ] + zone_id = var.cloudflare_mitchty_net_zoneid + name = "*" + value = "in2-smtp.messagingengine.com" + type = "MX" + priority = "20" + ttl = local.dns_ttl +} + +resource "cloudflare_record" "txt_mx_root_mitchty_net" { + depends_on = [ + cloudflare_record.root_mitchty_net, + cloudflare_record.splat_mitchty_net ] + zone_id = var.cloudflare_mitchty_net_zoneid + name = "@" + value = "v=spf1 include:spf.messagingengine.com ?all" + type = "TXT" + ttl = local.dns_ttl +} + +resource "cloudflare_record" "txt_mx_splat_mitchty_net" { + depends_on = [ + cloudflare_record.root_mitchty_net, + cloudflare_record.splat_mitchty_net ] + zone_id = var.cloudflare_mitchty_net_zoneid + name = "*" + value = "v=spf1 include:spf.messagingengine.com ?all" + type = "TXT" + ttl = local.dns_ttl +} diff --git a/functionalidiot.com.tf b/functionalidiot.com.tf index 8060d88..0efb4c0 100644 --- a/functionalidiot.com.tf +++ b/functionalidiot.com.tf @@ -119,14 +119,8 @@ resource "null_resource" "functionalidiot_com_setup_new_nginx" { } provisioner "remote-exec" { inline = [< /var/www/default/htdocs/index.html - +rm -fr /tmp/https-functionalidiot.com.conf rc-service nginx restart FIN ] diff --git a/http-default.conf b/http-default.conf index e5b7f1f..30f59e2 100644 --- a/http-default.conf +++ b/http-default.conf @@ -7,6 +7,8 @@ server { return 301 https://$host$request_uri; } + # Note: for any http setup, redirect all acme challenges here for all + # domains. Saves setting this up on multiple domains. location ^~ /.well-known/acme-challenge { alias /var/www/.well-known/acme-challenge; } diff --git a/https-functionalidiot.com.conf b/https-functionalidiot.com.conf index 578ac9b..8836e8d 100644 --- a/https-functionalidiot.com.conf +++ b/https-functionalidiot.com.conf @@ -25,8 +25,8 @@ server { server_name git.functionalidiot.com; - ssl_certificate /etc/ssl/uacme/functionalidiot.com/cert.pem; - ssl_certificate_key /etc/ssl/uacme/private/functionalidiot.com/key.pem; + ssl_certificate /etc/ssl/uacme/git.functionalidiot.com/cert.pem; + ssl_certificate_key /etc/ssl/uacme/private/git.functionalidiot.com/key.pem; ssl_stapling on; ssl_protocols TLSv1.2; diff --git a/https-mitchty.com.conf b/https-mitchty.com.conf new file mode 100644 index 0000000..0e5c27b --- /dev/null +++ b/https-mitchty.com.conf @@ -0,0 +1,40 @@ +server { + listen 443 ssl; + listen [::]:443 ssl; + server_name mitchty.com; + root /var/www/default/htdocs; + index index.htm index.html; + + ssl_certificate /etc/ssl/uacme/mitchty.com/cert.pem; + ssl_certificate_key /etc/ssl/uacme/private/mitchty.com/key.pem; + ssl_stapling on; + ssl_protocols TLSv1.2; + + location / { + try_files $uri $uri/ =404; + } + + location ^~ /.well-known/acme-challenge { + alias /var/www/.well-known/acme-challenge; + } +} + +server { + listen 443 ssl; + listen [::]:443 ssl; + + server_name git.mitchty.com; + + ssl_certificate /etc/ssl/uacme/git.mitchty.com/cert.pem; + ssl_certificate_key /etc/ssl/uacme/private/git.mitchty.com/key.pem; + ssl_stapling on; + ssl_protocols TLSv1.2; + + location / { + proxy_pass http://unix:/var/lib/gitea/unix-domain-socket:/; + } + + location ^~ /.well-known/acme-challenge { + alias /var/www/.well-known/acme-challenge; + } +} \ No newline at end of file diff --git a/https-mitchty.net.conf b/https-mitchty.net.conf new file mode 100644 index 0000000..43fde48 --- /dev/null +++ b/https-mitchty.net.conf @@ -0,0 +1,40 @@ +server { + listen 443 ssl; + listen [::]:443 ssl; + server_name mitchty.net; + root /var/www/default/htdocs; + index index.htm index.html; + + ssl_certificate /etc/ssl/uacme/mitchty.net/cert.pem; + ssl_certificate_key /etc/ssl/uacme/private/mitchty.net/key.pem; + ssl_stapling on; + ssl_protocols TLSv1.2; + + location / { + try_files $uri $uri/ =404; + } + + location ^~ /.well-known/acme-challenge { + alias /var/www/.well-known/acme-challenge; + } +} + +server { + listen 443 ssl; + listen [::]:443 ssl; + + server_name git.mitchty.net; + + ssl_certificate /etc/ssl/uacme/git.mitchty.net/cert.pem; + ssl_certificate_key /etc/ssl/uacme/private/git.mitchty.net/key.pem; + ssl_stapling on; + ssl_protocols TLSv1.2; + + location / { + proxy_pass http://unix:/var/lib/gitea/unix-domain-socket:/; + } + + location ^~ /.well-known/acme-challenge { + alias /var/www/.well-known/acme-challenge; + } +} \ No newline at end of file diff --git a/mitchty.com.tf b/mitchty.com.tf new file mode 100644 index 0000000..3ba6dfb --- /dev/null +++ b/mitchty.com.tf @@ -0,0 +1,22 @@ +resource "null_resource" "mitchty_com_nginx" { + depends_on = [ + null_resource.nginx_install, + ] + connection { + host = linode_instance.prod.ip_address + user = "root" + private_key = file("~/.ssh/id_rsa") + } + provisioner "file" { + source = "https-mitchty.com.conf" + destination = "/tmp/https-mitchty.com.conf" + } + provisioner "remote-exec" { + inline = [< /var/www/default/htdocs/index.html + rc-update add nginx default rc-service nginx restart +rm /tmp/http-default.conf FIN ] }