Some refactoring before I start adding further domains.

GNUmakefile

@@ -26,19 +26,24 @@ attic:
 	install -dm755 $@
 
 .PHONY: backup
-backup: backup-history backup-ssl backup-gitea
+backup: backup-history backup-ssl backup-gitea backup-syncthing
 
 .PHONY: backup-history
 backup-history: attic
 	-$(SSH) $(SSH_OPTS) root@`$(TF) output ipv4` 'cat /root/.ash_history' > attic/.ash_history.$(RUN_EPOCH)
-	[ -z attic/.ash_history.$(RUN_EPOCH) ] && rm attic/.ash_history.$(RUN_EPOCH) || ln -sf attic/.ash_history.$(RUN_EPOCH) attic/.ash_history
+	[ -z attic/.ash_history.$(RUN_EPOCH) ] && rm attic/.ash_history.$(RUN_EPOCH) || ln -f attic/.ash_history.$(RUN_EPOCH) attic/.ash_history
 
 .PHONY: backup-gitea
 backup-gitea: attic
-	$(SSH) $(SSH_OPTS) root@`$(TF) output ipv4` 'tar cvf - /var/lib/gitea /etc/gitea' > /attic/var-lib-gitea.tar.$(RUN_EPOCH)
-	ln -sf attic/var-lib-gitea.tar.$(RUN_EPOCH) attic/var-lib-gitea.tar
+	$(SSH) $(SSH_OPTS) root@`$(TF) output ipv4` 'tar --exclude /var/lib/gitea/unix-domain-socket -cvJf - /var/lib/gitea /etc/gitea' > attic/gitea.txz.$(RUN_EPOCH)
+	ln -f attic/gitea.txz.$(RUN_EPOCH) attic/gitea.txz
 
 .PHONY: backup-ssl
 backup-ssl: attic
-	$(SSH) $(SSH_OPTS) root@`$(TF) output ipv4` 'tar cvf - /etc/ssl/uacme' > attic/etc-ssl-uacme.tar.$(RUN_EPOCH)
-	ln -sf attic/etc-ssl-uacme.tar.$(RUN_EPOCH) attic/etc-ssl-uacme.tar
+	$(SSH) $(SSH_OPTS) root@`$(TF) output ipv4` 'tar cvJf - /etc/ssl/uacme' > attic/uacme.txz.$(RUN_EPOCH)
+	ln -f attic/uacme.txz.$(RUN_EPOCH) attic/uacme.txz
+
+.PHONY: backup-syncthing
+backup-syncthing: attic
+	$(SSH) $(SSH_OPTS) root@`$(TF) output ipv4` 'tar cvJf - /var/lib/syncthing' > attic/syncthing.txz.$(RUN_EPOCH)
+	ln -f attic/syncthing.txz.$(RUN_EPOCH) attic/syncthing.txz

functionalidiot.com.tf

@@ -8,6 +8,16 @@ variable "cloudflare_functionalidiot_zoneid" {
   type = string
 }
 
+variable "short_dns_ttl" {
+  type        = bool
+  default     = true
+  description = "Whether to set short dns ttl's or not."
+}
+
+locals {
+  dns_ttl = var.short_dns_ttl ? 120 : 43200
+}
+
 resource "cloudflare_record" "root" {
   depends_on = [
     linode_instance.prod,
@@ -17,7 +27,7 @@ resource "cloudflare_record" "root" {
   name       = "@"
   value      = linode_instance.prod.ip_address
   type       = "A"
-  ttl        = 120
+  ttl        = local.dns_ttl
 }
 
 resource "cloudflare_record" "splat" {
@@ -29,7 +39,7 @@ resource "cloudflare_record" "splat" {
   name       = "*"
   value      = linode_instance.prod.ip_address
   type       = "A"
-  ttl        = 1
+  ttl        = local.dns_ttl
 }
 
 # resource "cloudflare_record" "root6" {
@@ -41,7 +51,7 @@ resource "cloudflare_record" "splat" {
 #   name       = "@"
 #   value      = local.ipv6
 #   type       = "AAAA"
-#   ttl        = 120
+#   ttl        = local.dns_ttl
 # }
 
 # resource "cloudflare_record" "splat6" {
@@ -53,7 +63,7 @@ resource "cloudflare_record" "splat" {
 #   name       = "*"
 #   value      = local.ipv6
 #   type       = "AAAA"
-#   ttl        = 1
+#   ttl        = local.dns_ttl
 #   proxied    = true
 # }
 
@@ -65,7 +75,7 @@ resource "cloudflare_record" "www" {
   name       = "www"
   value      = "functionalidiot.com"
   type       = "CNAME"
-  ttl        = 120
+  ttl        = local.dns_ttl
 }
 
 resource "cloudflare_record" "git" {
@@ -76,7 +86,111 @@ resource "cloudflare_record" "git" {
   name       = "git"
   value      = "functionalidiot.com"
   type       = "CNAME"
-  ttl        = 120
+  ttl        = local.dns_ttl
+}
+
+# MX record setup for fastmail dkim/spf on root and all subdomains
+resource "cloudflare_record" "mx-cname-1" {
+  depends_on = [
+    cloudflare_record.root,
+    cloudflare_record.splat ]
+  zone_id    = var.cloudflare_functionalidiot_zoneid
+  name       = "fm1._domainkey"
+  value      = "fm1.functionalidiot.com.dkim.fmhosted.com"
+  type       = "CNAME"
+  ttl        = local.dns_ttl
+}
+
+resource "cloudflare_record" "mx-cname-2" {
+  depends_on = [
+    cloudflare_record.root,
+    cloudflare_record.splat ]
+  zone_id    = var.cloudflare_functionalidiot_zoneid
+  name       = "fm2._domainkey"
+  value      = "fm2.functionalidiot.com.dkim.fmhosted.com"
+  type       = "CNAME"
+  ttl        = local.dns_ttl
+}
+
+resource "cloudflare_record" "mx-cname-3" {
+  depends_on = [
+    cloudflare_record.root,
+    cloudflare_record.splat ]
+  zone_id    = var.cloudflare_functionalidiot_zoneid
+  name       = "fm3._domainkey"
+  value      = "fm3.functionalidiot.com.dkim.fmhosted.com"
+  type       = "CNAME"
+  ttl        = local.dns_ttl
+}
+
+resource "cloudflare_record" "mx-10-root" {
+  depends_on = [
+    cloudflare_record.root,
+    cloudflare_record.splat ]
+  zone_id  = var.cloudflare_functionalidiot_zoneid
+  name     = "@"
+  value    = "in1-smtp.messagingengine.com"
+  type     = "MX"
+  priority = "10"
+  ttl      = local.dns_ttl
+}
+
+resource "cloudflare_record" "mx-20-root" {
+  depends_on = [
+    cloudflare_record.root,
+    cloudflare_record.splat ]
+  zone_id  = var.cloudflare_functionalidiot_zoneid
+  name     = "@"
+  value    = "in2-smtp.messagingengine.com"
+  type     = "MX"
+  priority = "20"
+  ttl      = local.dns_ttl
+}
+
+resource "cloudflare_record" "mx-10-splat" {
+  depends_on = [
+    cloudflare_record.root,
+    cloudflare_record.splat ]
+  zone_id  = var.cloudflare_functionalidiot_zoneid
+  name     = "*"
+  value    = "in1-smtp.messagingengine.com"
+  type     = "MX"
+  priority = "10"
+  ttl      = local.dns_ttl
+}
+
+resource "cloudflare_record" "mx-20-splat" {
+  depends_on = [
+    cloudflare_record.root,
+    cloudflare_record.splat ]
+  zone_id  = var.cloudflare_functionalidiot_zoneid
+  name     = "*"
+  value    = "in2-smtp.messagingengine.com"
+  type     = "MX"
+  priority = "20"
+  ttl      = local.dns_ttl
+}
+
+resource "cloudflare_record" "txt-mx-root" {
+  depends_on = [
+    cloudflare_record.root,
+    cloudflare_record.splat ]
+  zone_id  = var.cloudflare_functionalidiot_zoneid
+  name     = "@"
+  value    = "v=spf1 include:spf.messagingengine.com ?all"
+  type     = "TXT"
+  ttl      = local.dns_ttl
+}
+
+resource "cloudflare_record" "txt-mx-splat" {
+  depends_on = [
+    cloudflare_record.root,
+    cloudflare_record.splat ]
+  zone_id  = var.cloudflare_functionalidiot_zoneid
+  name     = "*"
+  value    = "v=spf1 include:spf.messagingengine.com ?all"
+  type     = "TXT"
+  ttl      = local.dns_ttl
 }
 
 resource "cloudflare_record" "functionalidiot_com_ns1" {
@@ -94,8 +208,8 @@ resource "cloudflare_record" "functionalidiot_com_ns2" {
 }
 
 resource "null_resource" "functionalidiot_com_setup_new_gitea" {
-  depends_on = [ null_resource.post_setup ]
-  count      = fileexists("${path.module}/attic/var-lib-gitea.tar") ? 0 : 1
+  depends_on = [ null_resource.gitea_install ]
+  count      = fileexists("${path.module}/attic/gitea.txz") ? 0 : 1
   connection {
     host        = linode_instance.prod.ip_address
     user        = "root"
@@ -126,62 +240,71 @@ chown gitea:www-data /var/lib/gitea/db/gitea.db
 
 su - gitea -c "gitea migrate --config /etc/gitea/app.ini"
 
-su - gitea -c "gitea admin create-user --username mitch --password ${var.gitea_db_passwd} --email spam@mitchty.com --admin --config /etc/gitea/app.ini"
+su - gitea -c "gitea admin create-user --username mitchty --password ${var.gitea_db_passwd} --email git@functionalidiot.com --admin --config /etc/gitea/app.ini"
 FIN
     ]
   }
 }
 
-resource "null_resource" "functionalidiot_com_setup_saved_uacme" {
-  depends_on = [ null_resource.post_setup ]
-  count      = fileexists("${path.module}/attic/etc-ssl-uacme.tar") ? 1 : 0
+resource "null_resource" "functionalidiot_com_setup_saved_gitea" {
+  depends_on = [ null_resource.gitea_install ]
+  count      = fileexists("${path.module}/attic/gitea.txz") ? 1 : 0
   connection {
     host        = linode_instance.prod.ip_address
     user        = "root"
     private_key = file("~/.ssh/id_rsa")
   }
   provisioner "file" {
-    source      = "etc-ssl-uacme.tar"
-    destination = "/tmp/etc-ssl-uacme.tar"
+    source      = "${path.module}/attic/gitea.txz"
+    destination = "/tmp/gitea.txz"
   }
   # TODO: Finish post untar setup
   provisioner "remote-exec" {
     inline = [<<FIN
 cd /
-tar xvf /tmp/etc-ssl-uacme.tar
+tar xvJf /tmp/gitea.txz
+rc-update add gitea default
+rc-service gitea restart
 FIN
     ]
   }
 }
 
-resource "null_resource" "functionalidiot_com_setup_saved_gitea" {
-  depends_on = [ null_resource.post_setup ]
-  count      = fileexists("${path.module}/attic/var-lib-gitea.tar") ? 1 : 0
+resource "null_resource" "functionalidiot_com_setup_saved_uacme" {
+  depends_on = [ null_resource.uacme_install ]
+  count      = fileexists("${path.module}/attic/uacme.txz") ? 1 : 0
   connection {
     host        = linode_instance.prod.ip_address
     user        = "root"
     private_key = file("~/.ssh/id_rsa")
   }
   provisioner "file" {
-    source      = "var-lib-gitea.tar"
-    destination = "/tmp/var-lib-gitea.tar"
+    source      = "${path.module}/attic/uacme.txz"
+    destination = "/tmp/uacme.txz"
   }
   # TODO: Finish post untar setup
   provisioner "remote-exec" {
     inline = [<<FIN
 cd /
-tar xvf /tmp/var-lib-gitea.tar
-rc-update add gitea default
-rc-service gitea restart
+tar xvJf /tmp/uacme.txz
 FIN
     ]
   }
 }
 
+# FIXME: This nginx setup isn't idempotent if its a new setup vs saved
+# uacme ssl setup.
+#
+# Maybe use the dns uacme crap instead of this stupid http bs?
+#
+# https://www.terraform.io/docs/providers/acme/r/certificate.html
+# https://www.terraform.io/docs/providers/acme/dns_providers/cloudflare.html
 resource "null_resource" "functionalidiot_com_setup_new_nginx" {
   depends_on = [
-    null_resource.post_setup,
+    null_resource.nginx_install,
+    null_resource.functionalidiot_com_setup_new_gitea,
     null_resource.functionalidiot_com_setup_saved_gitea,
+    null_resource.functionalidiot_com_setup_saved_uacme,
     null_resource.functionalidiot_com_setup_saved_uacme
   ]
   connection {

https-functionalidiot.com.conf

@@ -1,11 +1,29 @@
 server {
     listen 443 ssl default_server;
     listen [::]:443 ssl default_server;
-    # TODO: fixme
-    # server_name functionalidiot.com;
-    server_name _;
-#    server_name_in_redirect off;
+    server_name functionalidiot.com;
     root  /var/www/default/htdocs;
+    index index.htm index.html;
+
+    ssl_certificate /etc/ssl/uacme/functionalidiot.com/cert.pem;
+    ssl_certificate_key /etc/ssl/uacme/private/functionalidiot.com/key.pem;
+    ssl_stapling on;
+    ssl_protocols TLSv1.2;
+
+    location / {
+        try_files $uri $uri/ =404;
+    }
+
+    location ^~ /.well-known/acme-challenge {
+        alias /var/www/.well-known/acme-challenge;
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+
+    server_name git.functionalidiot.com;
 
     ssl_certificate /etc/ssl/uacme/functionalidiot.com/cert.pem;
     ssl_certificate_key /etc/ssl/uacme/private/functionalidiot.com/key.pem;

main.tf

@@ -18,5 +18,13 @@ resource "linode_instance" "prod" {
 }
 
 output "ipv4" {
-  value = "${linode_instance.prod.ip_address}"
+  value = linode_instance.prod.ip_address
+}
+
+locals {
+  ipv6 = split("/", linode_instance.prod.ipv6)[0]
+}
+
+output "ipv6" {
+  value = local.ipv6
 }

post_setup.tf

@@ -9,12 +9,58 @@ resource "null_resource" "post_setup" {
     inline = [<<FIN
 apk update
 apk upgrade
-apk add nginx muacme gitea iproute2 sqlite bind-tools
-rc-update add nginx default
-rc-service nginx restart
+apk add iproute2 sqlite bind-tools tar xz
 sed -i -e 's/AllowTcpForwarding .*/AllowTcpForwarding yes/g' /etc/ssh/sshd_config
 rc-service sshd restart
 FIN
     ]
   }
 }
+
+resource "null_resource" "nginx_install" {
+  depends_on = [ linode_instance.post_setup ]
+  connection {
+    host        = linode_instance.prod.ip_address
+    user        = "root"
+    private_key = file("~/.ssh/id_rsa")
+  }
+  provisioner "remote-exec" {
+    inline = [<<FIN
+flock -x /tmp/apk -c 'apk add nginx'
+apk add nginx muacme gitea iproute2 sqlite bind-tools tar xz
+rc-update add nginx default
+rc-service nginx restart
+FIN
+    ]
+  }
+}
+
+resource "null_resource" "uacme_install" {
+  depends_on = [ linode_instance.post_setup ]
+  connection {
+    host        = linode_instance.prod.ip_address
+    user        = "root"
+    private_key = file("~/.ssh/id_rsa")
+  }
+  provisioner "remote-exec" {
+    inline = [<<FIN
+flock -x /tmp/apk -c 'apk add muacme'
+FIN
+    ]
+  }
+}
+
+resource "null_resource" "gitea_install" {
+  depends_on = [ linode_instance.post_setup ]
+  connection {
+    host        = linode_instance.prod.ip_address
+    user        = "root"
+    private_key = file("~/.ssh/id_rsa")
+  }
+  provisioner "remote-exec" {
+    inline = [<<FIN
+flock -x /tmp/apk -c 'apk add gitea'
+FIN
+    ]
+  }
+}

setup_gitea.sh

@@ -7,6 +7,10 @@ if ! grep HTTP_ADDR $gitea_ini; then
     sed -i -e '/\[server\]/a HTTP_ADDR = /var/lib/gitea/unix-domain-socket' $gitea_ini
     sed -i -e '/\[server\]/a PROTOCOL = unix' $gitea_ini
     sed -i -e '/\[server\]/a UNIX_SOCKET_PERMISSION = 666' $gitea_ini
+    sed -i -e '/\[server\]/a START_SSH_SERVER = true' $gitea_ini
+    sed -i -e '/\[server\]/a SSH_DOMAIN = git.functionalidiot.com' $gitea_ini
+    sed -i -e '/\[server\]/a SSH_PORT = 2222' $gitea_ini
+    sed -i -e '/\[server\]/a SSH_LISTEN_PORT = 2222' $gitea_ini
 fi
 
 if ! grep OFFLINE_MODE $gitea_ini; then
@@ -16,7 +20,7 @@ fi
 
 # Change the gitea APP_NAME
 if ! grep APP_NAME $gitea_ini; then
-    sed -i -e '/^RUN_MODE.*/a APP_NAME = mitchtys git house' $gitea_ini
+    sed -i -e '/^RUN_MODE.*/a APP_NAME = just a bunch of git repos' $gitea_ini
 fi
 
 # Ensure all new repos are private by default
@@ -76,5 +80,9 @@ ENABLED = false
 [picture]
 DISABLE_GRAVATAR        = false
 ENABLE_FEDERATED_AVATAR = true
+
+[git]
+MAX_GIT_DIFF_LINES           = 20000
+MAX_GIT_DIFF_LINE_CHARACTERS = 100000
 FIN
 fi