Add mitchty.net setup so far, may be incomplete, checkpoint commit

GNUmakefile

@@ -11,9 +11,13 @@ all: up
 rebuild: down up
 
 .PHONY: up
-up:
+up: plan
 	$(TF) apply -auto-approve
 
+.PHONY: plan
+plan:
+	$(TF) plan
+
 .PHONY: down
 down:
 	$(TF) destroy -auto-approve

dns-mitchty.net.tf

@@ -0,0 +1,204 @@
+variable "cloudflare_mitchty_net_zoneid" {
+  type = string
+}
+
+resource "cloudflare_record" "ns1_mitchty_net" {
+  zone_id    = var.cloudflare_mitchty_net_zoneid
+  name       = "@"
+  value      = "mitch.ns.cloudflare.com"
+  type       = "NS"
+}
+
+resource "cloudflare_record" "ns2_mitchty_net" {
+  zone_id    = var.cloudflare_mitchty_net_zoneid
+  name       = "@"
+  value      = "tegan.ns.cloudflare.com"
+  type       = "NS"
+}
+
+resource "cloudflare_record" "root_mitchty_net" {
+  depends_on = [
+    linode_instance.prod,
+    cloudflare_record.ns1_mitchty_net,
+    cloudflare_record.ns2_mitchty_net ]
+  zone_id    = var.cloudflare_mitchty_net_zoneid
+  name       = "@"
+  value      = linode_instance.prod.ip_address
+  type       = "A"
+  ttl        = local.dns_ttl
+}
+
+resource "cloudflare_record" "splat_mitchty_net" {
+  depends_on = [
+    linode_instance.prod,
+    cloudflare_record.ns1_mitchty_net,
+    cloudflare_record.ns2_mitchty_net ]
+  zone_id    = var.cloudflare_mitchty_net_zoneid
+  name       = "*"
+  value      = linode_instance.prod.ip_address
+  type       = "A"
+  ttl        = local.dns_ttl
+}
+
+# resource "cloudflare_record" "root6_mitchty_net" {
+#   depends_on = [
+#     linode_instance.prod,
+#     cloudflare_record.ns1_mitchty_net,
+#     cloudflare_record.ns2_mitchty_net ]
+#   zone_id    = var.cloudflare_mitchty_net_zoneid
+#   name       = "@"
+#   value      = local.ipv6
+#   type       = "AAAA"
+#   ttl        = local.dns_ttl
+# }
+
+# resource "cloudflare_record" "splat6_mitchty_net" {
+#   depends_on = [
+#     linode_instance.prod,
+#     cloudflare_record.ns1_mitchty_net,
+#     cloudflare_record.ns2_mitchty_net ]
+#   zone_id    = var.cloudflare_mitchty_net_zoneid
+#   name       = "*"
+#   value      = local.ipv6
+#   type       = "AAAA"
+#   ttl        = local.dns_ttl
+#   proxied    = true
+# }
+
+
+resource "cloudflare_record" "home_mitchty_net" {
+  depends_on = [
+    cloudflare_record.root_mitchty_net,
+    cloudflare_record.splat_mitchty_net ]
+  zone_id    = var.cloudflare_mitchty_net_zoneid
+  name       = "home"
+  value      = "24.118.92.50"
+  type       = "A"
+  ttl        = local.dns_ttl
+}
+
+resource "cloudflare_record" "www_mitchty_net" {
+  depends_on = [
+    cloudflare_record.root_mitchty_net,
+    cloudflare_record.splat_mitchty_net ]
+  zone_id    = var.cloudflare_mitchty_net_zoneid
+  name       = "www"
+  value      = "mitchty.net"
+  type       = "CNAME"
+  ttl        = local.dns_ttl
+}
+
+resource "cloudflare_record" "git_mitchty_net" {
+  depends_on = [
+    cloudflare_record.root_mitchty_net,
+    cloudflare_record.splat_mitchty_net ]
+  zone_id    = var.cloudflare_mitchty_net_zoneid
+  name       = "git"
+  value      = "mitchty.net"
+  type       = "CNAME"
+  ttl        = local.dns_ttl
+}
+
+# MX record setup for fastmail dkim/spf on root and all subdomains
+resource "cloudflare_record" "mx_cname_1_mitchty_net" {
+  depends_on = [
+    cloudflare_record.root_mitchty_net,
+    cloudflare_record.splat_mitchty_net ]
+  zone_id    = var.cloudflare_mitchty_net_zoneid
+  name       = "fm1._domainkey"
+  value      = "fm1.mitchty.net.dkim.fmhosted.net"
+  type       = "CNAME"
+  ttl        = local.dns_ttl
+}
+
+resource "cloudflare_record" "mx_cname_2_mitchty_net" {
+  depends_on = [
+    cloudflare_record.root_mitchty_net,
+    cloudflare_record.splat_mitchty_net ]
+  zone_id    = var.cloudflare_mitchty_net_zoneid
+  name       = "fm2._domainkey"
+  value      = "fm2.mitchty.net.dkim.fmhosted.net"
+  type       = "CNAME"
+  ttl        = local.dns_ttl
+}
+
+resource "cloudflare_record" "mx_cname_3_mitchty_net" {
+  depends_on = [
+    cloudflare_record.root_mitchty_net,
+    cloudflare_record.splat_mitchty_net ]
+  zone_id    = var.cloudflare_mitchty_net_zoneid
+  name       = "fm3._domainkey"
+  value      = "fm3.mitchty.net.dkim.fmhosted.net"
+  type       = "CNAME"
+  ttl        = local.dns_ttl
+}
+
+resource "cloudflare_record" "mx_10_root_mitchty_net" {
+  depends_on = [
+    cloudflare_record.root_mitchty_net,
+    cloudflare_record.splat_mitchty_net ]
+  zone_id  = var.cloudflare_mitchty_net_zoneid
+  name     = "@"
+  value    = "in1-smtp.messagingengine.com"
+  type     = "MX"
+  priority = "10"
+  ttl      = local.dns_ttl
+}
+
+resource "cloudflare_record" "mx_20_root_mitchty_net" {
+  depends_on = [
+    cloudflare_record.root_mitchty_net,
+    cloudflare_record.splat_mitchty_net ]
+  zone_id  = var.cloudflare_mitchty_net_zoneid
+  name     = "@"
+  value    = "in2-smtp.messagingengine.com"
+  type     = "MX"
+  priority = "20"
+  ttl      = local.dns_ttl
+}
+
+resource "cloudflare_record" "mx_10_splat_mitchty_net" {
+  depends_on = [
+    cloudflare_record.root_mitchty_net,
+    cloudflare_record.splat_mitchty_net ]
+  zone_id  = var.cloudflare_mitchty_net_zoneid
+  name     = "*"
+  value    = "in1-smtp.messagingengine.com"
+  type     = "MX"
+  priority = "10"
+  ttl      = local.dns_ttl
+}
+
+resource "cloudflare_record" "mx_20_splat_mitchty_net" {
+  depends_on = [
+    cloudflare_record.root_mitchty_net,
+    cloudflare_record.splat_mitchty_net ]
+  zone_id  = var.cloudflare_mitchty_net_zoneid
+  name     = "*"
+  value    = "in2-smtp.messagingengine.com"
+  type     = "MX"
+  priority = "20"
+  ttl      = local.dns_ttl
+}
+
+resource "cloudflare_record" "txt_mx_root_mitchty_net" {
+  depends_on = [
+    cloudflare_record.root_mitchty_net,
+    cloudflare_record.splat_mitchty_net ]
+  zone_id  = var.cloudflare_mitchty_net_zoneid
+  name     = "@"
+  value    = "v=spf1 include:spf.messagingengine.com ?all"
+  type     = "TXT"
+  ttl      = local.dns_ttl
+}
+
+resource "cloudflare_record" "txt_mx_splat_mitchty_net" {
+  depends_on = [
+    cloudflare_record.root_mitchty_net,
+    cloudflare_record.splat_mitchty_net ]
+  zone_id  = var.cloudflare_mitchty_net_zoneid
+  name     = "*"
+  value    = "v=spf1 include:spf.messagingengine.com ?all"
+  type     = "TXT"
+  ttl      = local.dns_ttl
+}

functionalidiot.com.tf

@@ -119,14 +119,8 @@ resource "null_resource" "functionalidiot_com_setup_new_nginx" {
   }
   provisioner "remote-exec" {
     inline = [<<FIN
-[ -e /etc/nginx/conf.d/default.conf ] && mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf.disable
-install -m644 /tmp/http-default.conf /etc/nginx/conf.d/http-default.conf
 install -m644 /tmp/https-functionalidiot.com.conf /etc/nginx/conf.d/https-functionalidiot.com.conf
-rm -fr /tmp/*.conf
-
-install -dm755 /var/www/default/htdocs /var/www/.well-known/acme-challenge
-echo todo write more stuff > /var/www/default/htdocs/index.html
-
+rm -fr /tmp/https-functionalidiot.com.conf
 rc-service nginx restart
 FIN
     ]

http-default.conf

@@ -7,6 +7,8 @@ server {
         return 301 https://$host$request_uri;
     }
 
+    # Note: for any http setup, redirect all acme challenges here for all
+    # domains. Saves setting this up on multiple domains.
     location ^~ /.well-known/acme-challenge {
         alias /var/www/.well-known/acme-challenge;
     }

https-functionalidiot.com.conf

@@ -25,8 +25,8 @@ server {
 
     server_name git.functionalidiot.com;
 
-    ssl_certificate /etc/ssl/uacme/functionalidiot.com/cert.pem;
-    ssl_certificate_key /etc/ssl/uacme/private/functionalidiot.com/key.pem;
+    ssl_certificate /etc/ssl/uacme/git.functionalidiot.com/cert.pem;
+    ssl_certificate_key /etc/ssl/uacme/private/git.functionalidiot.com/key.pem;
     ssl_stapling on;
     ssl_protocols TLSv1.2;
 

https-mitchty.com.conf

@@ -0,0 +1,40 @@
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name mitchty.com;
+    root  /var/www/default/htdocs;
+    index index.htm index.html;
+
+    ssl_certificate /etc/ssl/uacme/mitchty.com/cert.pem;
+    ssl_certificate_key /etc/ssl/uacme/private/mitchty.com/key.pem;
+    ssl_stapling on;
+    ssl_protocols TLSv1.2;
+
+    location / {
+        try_files $uri $uri/ =404;
+    }
+
+    location ^~ /.well-known/acme-challenge {
+        alias /var/www/.well-known/acme-challenge;
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+
+    server_name git.mitchty.com;
+
+    ssl_certificate /etc/ssl/uacme/git.mitchty.com/cert.pem;
+    ssl_certificate_key /etc/ssl/uacme/private/git.mitchty.com/key.pem;
+    ssl_stapling on;
+    ssl_protocols TLSv1.2;
+
+    location / {
+        proxy_pass http://unix:/var/lib/gitea/unix-domain-socket:/;
+    }
+
+    location ^~ /.well-known/acme-challenge {
+        alias /var/www/.well-known/acme-challenge;
+    }
+}

https-mitchty.net.conf

@@ -0,0 +1,40 @@
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name mitchty.net;
+    root  /var/www/default/htdocs;
+    index index.htm index.html;
+
+    ssl_certificate /etc/ssl/uacme/mitchty.net/cert.pem;
+    ssl_certificate_key /etc/ssl/uacme/private/mitchty.net/key.pem;
+    ssl_stapling on;
+    ssl_protocols TLSv1.2;
+
+    location / {
+        try_files $uri $uri/ =404;
+    }
+
+    location ^~ /.well-known/acme-challenge {
+        alias /var/www/.well-known/acme-challenge;
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+
+    server_name git.mitchty.net;
+
+    ssl_certificate /etc/ssl/uacme/git.mitchty.net/cert.pem;
+    ssl_certificate_key /etc/ssl/uacme/private/git.mitchty.net/key.pem;
+    ssl_stapling on;
+    ssl_protocols TLSv1.2;
+
+    location / {
+        proxy_pass http://unix:/var/lib/gitea/unix-domain-socket:/;
+    }
+
+    location ^~ /.well-known/acme-challenge {
+        alias /var/www/.well-known/acme-challenge;
+    }
+}

mitchty.com.tf

@@ -0,0 +1,22 @@
+resource "null_resource" "mitchty_com_nginx" {
+  depends_on = [
+    null_resource.nginx_install,
+  ]
+  connection {
+    host        = linode_instance.prod.ip_address
+    user        = "root"
+    private_key = file("~/.ssh/id_rsa")
+  }
+  provisioner "file" {
+    source      = "https-mitchty.com.conf"
+    destination = "/tmp/https-mitchty.com.conf"
+  }
+  provisioner "remote-exec" {
+    inline = [<<FIN
+install -m644 /tmp/https-mitchty.com.conf /etc/nginx/conf.d/https-mitchty.com.conf
+rm -fr /tmp/https-mitchty.com.conf
+rc-service nginx restart
+FIN
+    ]
+  }
+}

mitchty.net.tf

@@ -0,0 +1,22 @@
+resource "null_resource" "mitchty_net_nginx" {
+  depends_on = [
+    null_resource.nginx_install,
+  ]
+  connection {
+    host        = linode_instance.prod.ip_address
+    user        = "root"
+    private_key = file("~/.ssh/id_rsa")
+  }
+  provisioner "file" {
+    source      = "https-mitchty.net.conf"
+    destination = "/tmp/https-mitchty.net.conf"
+  }
+  provisioner "remote-exec" {
+    inline = [<<FIN
+install -m644 /tmp/https-mitchty.net.conf /etc/nginx/conf.d/https-mitchty.net.conf
+rm -fr /tmp/https-mitchty.net.conf
+rc-service nginx restart
+FIN
+    ]
+  }
+}

post_setup.tf

@@ -24,12 +24,22 @@ resource "null_resource" "nginx_install" {
     user        = "root"
     private_key = file("~/.ssh/id_rsa")
   }
+  provisioner "file" {
+    source      = "http-default.conf"
+    destination = "/tmp/http-default.conf"
+  }
   provisioner "remote-exec" {
     inline = [<<FIN
 flock -x /tmp/apk -c 'apk add nginx'
-apk add nginx muacme gitea iproute2 sqlite bind-tools tar xz
+[ -e /etc/nginx/conf.d/default.conf ] && mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf.disable
+install -m644 /tmp/http-default.conf /etc/nginx/conf.d/http-default.conf
+
+install -dm755 /var/www/default/htdocs /var/www/.well-known/acme-challenge
+echo todo write more stuff > /var/www/default/htdocs/index.html
+
 rc-update add nginx default
 rc-service nginx restart
+rm /tmp/http-default.conf
 FIN
     ]
   }