From 9bcf908ce58f880e0a78728633f2352f487c1ea4 Mon Sep 17 00:00:00 2001 From: Mitch Tishmack Date: Sun, 20 Sep 2020 13:45:36 -0500 Subject: [PATCH] Checkpoint commit --- .gitignore | 1 + GNUmakefile | 22 +++++ functionalidiot.com.tf | 163 +++++++++++++++++++++++++++++---- http-default.conf | 13 +++ https-functionalidiot.com.conf | 22 +++++ setup_gitea.sh | 4 +- 6 files changed, 204 insertions(+), 21 deletions(-) create mode 100644 http-default.conf create mode 100644 https-functionalidiot.com.conf diff --git a/.gitignore b/.gitignore index e4d60d0..6f2eb94 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,4 @@ terraform.tfvars .terraform terraform.tfstate terraform.tfstate.backup +attic diff --git a/GNUmakefile b/GNUmakefile index 810763a..a9115aa 100644 --- a/GNUmakefile +++ b/GNUmakefile @@ -2,6 +2,7 @@ TF:=terraform SSH:=ssh USER_SSH_OPTS:= SSH_OPTS:=-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no $(USER_SSH_OPTS) +RUN_EPOCH:=$(shell date +%s) .PHONY: all all: up @@ -20,3 +21,24 @@ down: .PHONY: ssh ssh: $(SSH) $(SSH_OPTS) root@`$(TF) output ipv4` + +attic: + install -dm755 $@ + +.PHONY: backup +backup: backup-history backup-ssl backup-gitea + +.PHONY: backup-history +backup-history: attic + -$(SSH) $(SSH_OPTS) root@`$(TF) output ipv4` 'cat /root/.ash_history' > attic/.ash_history.$(RUN_EPOCH) + [ -z attic/.ash_history.$(RUN_EPOCH) ] && rm attic/.ash_history.$(RUN_EPOCH) || ln -sf attic/.ash_history.$(RUN_EPOCH) attic/.ash_history + +.PHONY: backup-gitea +backup-gitea: attic + $(SSH) $(SSH_OPTS) root@`$(TF) output ipv4` 'tar cvf - /var/lib/gitea /etc/gitea' > /attic/var-lib-gitea.tar.$(RUN_EPOCH) + ln -sf attic/var-lib-gitea.tar.$(RUN_EPOCH) attic/var-lib-gitea.tar + +.PHONY: backup-ssl +backup-ssl: attic + $(SSH) $(SSH_OPTS) root@`$(TF) output ipv4` 'tar cvf - /etc/ssl/uacme' > attic/etc-ssl-uacme.tar.$(RUN_EPOCH) + ln -sf attic/etc-ssl-uacme.tar.$(RUN_EPOCH) attic/etc-ssl-uacme.tar diff --git a/functionalidiot.com.tf b/functionalidiot.com.tf index 735510f..ff791f5 100644 --- a/functionalidiot.com.tf +++ b/functionalidiot.com.tf @@ -8,18 +8,6 @@ variable "cloudflare_functionalidiot_zoneid" { type = string } -resource "cloudflare_record" "www" { - depends_on = [ - cloudflare_record.root, - cloudflare_record.splat ] - zone_id = var.cloudflare_functionalidiot_zoneid - name = "www" - value = "functionalidiot.com" - type = "CNAME" - ttl = 1 - proxied = true -} - resource "cloudflare_record" "root" { depends_on = [ linode_instance.prod, @@ -29,8 +17,7 @@ resource "cloudflare_record" "root" { name = "@" value = linode_instance.prod.ip_address type = "A" - ttl = 1 - proxied = true + ttl = 120 } resource "cloudflare_record" "splat" { @@ -43,7 +30,53 @@ resource "cloudflare_record" "splat" { value = linode_instance.prod.ip_address type = "A" ttl = 1 - proxied = true +} + +# resource "cloudflare_record" "root6" { +# depends_on = [ +# linode_instance.prod, +# cloudflare_record.functionalidiot_com_ns1, +# cloudflare_record.functionalidiot_com_ns2 ] +# zone_id = var.cloudflare_functionalidiot_zoneid +# name = "@" +# value = local.ipv6 +# type = "AAAA" +# ttl = 120 +# } + +# resource "cloudflare_record" "splat6" { +# depends_on = [ +# linode_instance.prod, +# cloudflare_record.functionalidiot_com_ns1, +# cloudflare_record.functionalidiot_com_ns2 ] +# zone_id = var.cloudflare_functionalidiot_zoneid +# name = "*" +# value = local.ipv6 +# type = "AAAA" +# ttl = 1 +# proxied = true +# } + +resource "cloudflare_record" "www" { + depends_on = [ + cloudflare_record.root, + cloudflare_record.splat ] + zone_id = var.cloudflare_functionalidiot_zoneid + name = "www" + value = "functionalidiot.com" + type = "CNAME" + ttl = 120 +} + +resource "cloudflare_record" "git" { + depends_on = [ + cloudflare_record.root, + cloudflare_record.splat ] + zone_id = var.cloudflare_functionalidiot_zoneid + name = "git" + value = "functionalidiot.com" + type = "CNAME" + ttl = 120 } resource "cloudflare_record" "functionalidiot_com_ns1" { @@ -60,8 +93,9 @@ resource "cloudflare_record" "functionalidiot_com_ns2" { type = "NS" } -resource "null_resource" "functionalidiot_com_setup" { +resource "null_resource" "functionalidiot_com_setup_new_gitea" { depends_on = [ null_resource.post_setup ] + count = fileexists("${path.module}/attic/var-lib-gitea.tar") ? 0 : 1 connection { host = linode_instance.prod.ip_address user = "root" @@ -74,18 +108,107 @@ resource "null_resource" "functionalidiot_com_setup" { provisioner "remote-exec" { inline = [< /var/www/default/htdocs/index.html + +rc-service nginx restart +FIN + ] + } +} diff --git a/http-default.conf b/http-default.conf new file mode 100644 index 0000000..e5b7f1f --- /dev/null +++ b/http-default.conf @@ -0,0 +1,13 @@ +# Redirect all http traffic +server { + listen 80 default_server; + listen [::]:80 default_server; + + location / { + return 301 https://$host$request_uri; + } + + location ^~ /.well-known/acme-challenge { + alias /var/www/.well-known/acme-challenge; + } +} diff --git a/https-functionalidiot.com.conf b/https-functionalidiot.com.conf new file mode 100644 index 0000000..4fa4d54 --- /dev/null +++ b/https-functionalidiot.com.conf @@ -0,0 +1,22 @@ +server { + listen 443 ssl default_server; + listen [::]:443 ssl default_server; + # TODO: fixme + # server_name functionalidiot.com; + server_name _; +# server_name_in_redirect off; + root /var/www/default/htdocs; + + ssl_certificate /etc/ssl/uacme/functionalidiot.com/cert.pem; + ssl_certificate_key /etc/ssl/uacme/private/functionalidiot.com/key.pem; + ssl_stapling on; + ssl_protocols TLSv1.2; + + location / { + proxy_pass http://unix:/var/lib/gitea/unix-domain-socket:/; + } + + location ^~ /.well-known/acme-challenge { + alias /var/www/.well-known/acme-challenge; + } +} \ No newline at end of file diff --git a/setup_gitea.sh b/setup_gitea.sh index 327f1e6..4205cf6 100755 --- a/setup_gitea.sh +++ b/setup_gitea.sh @@ -4,7 +4,9 @@ gitea_ini=/etc/gitea/app.ini # We want to listen on 127.0.0.1 instead of 0.0.0.0 for now if ! grep HTTP_ADDR $gitea_ini; then - sed -i -e '/\[server\]/a HTTP_ADDR=127.0.0.1' $gitea_ini + sed -i -e '/\[server\]/a HTTP_ADDR = /var/lib/gitea/unix-domain-socket' $gitea_ini + sed -i -e '/\[server\]/a PROTOCOL = unix' $gitea_ini + sed -i -e '/\[server\]/a UNIX_SOCKET_PERMISSION = 666' $gitea_ini fi if ! grep OFFLINE_MODE $gitea_ini; then