Checkpoint commit

.gitignore

@@ -2,3 +2,4 @@ terraform.tfvars
 .terraform
 terraform.tfstate
 terraform.tfstate.backup
+attic

GNUmakefile

@@ -2,6 +2,7 @@ TF:=terraform
 SSH:=ssh
 USER_SSH_OPTS:=
 SSH_OPTS:=-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no $(USER_SSH_OPTS)
+RUN_EPOCH:=$(shell date +%s)
 
 .PHONY: all
 all: up
@@ -20,3 +21,24 @@ down:
 .PHONY: ssh
 ssh:
 	$(SSH) $(SSH_OPTS) root@`$(TF) output ipv4`
+
+attic:
+	install -dm755 $@
+
+.PHONY: backup
+backup: backup-history backup-ssl backup-gitea
+
+.PHONY: backup-history
+backup-history: attic
+	-$(SSH) $(SSH_OPTS) root@`$(TF) output ipv4` 'cat /root/.ash_history' > attic/.ash_history.$(RUN_EPOCH)
+	[ -z attic/.ash_history.$(RUN_EPOCH) ] && rm attic/.ash_history.$(RUN_EPOCH) || ln -sf attic/.ash_history.$(RUN_EPOCH) attic/.ash_history
+
+.PHONY: backup-gitea
+backup-gitea: attic
+	$(SSH) $(SSH_OPTS) root@`$(TF) output ipv4` 'tar cvf - /var/lib/gitea /etc/gitea' > /attic/var-lib-gitea.tar.$(RUN_EPOCH)
+	ln -sf attic/var-lib-gitea.tar.$(RUN_EPOCH) attic/var-lib-gitea.tar
+
+.PHONY: backup-ssl
+backup-ssl: attic
+	$(SSH) $(SSH_OPTS) root@`$(TF) output ipv4` 'tar cvf - /etc/ssl/uacme' > attic/etc-ssl-uacme.tar.$(RUN_EPOCH)
+	ln -sf attic/etc-ssl-uacme.tar.$(RUN_EPOCH) attic/etc-ssl-uacme.tar

functionalidiot.com.tf

@@ -8,18 +8,6 @@ variable "cloudflare_functionalidiot_zoneid" {
   type = string
 }
 
-resource "cloudflare_record" "www" {
-  depends_on = [
-    cloudflare_record.root,
-    cloudflare_record.splat ]
-  zone_id    = var.cloudflare_functionalidiot_zoneid
-  name       = "www"
-  value      = "functionalidiot.com"
-  type       = "CNAME"
-  ttl        = 1
-  proxied    = true
-}
-
 resource "cloudflare_record" "root" {
   depends_on = [
     linode_instance.prod,
@@ -29,8 +17,7 @@ resource "cloudflare_record" "root" {
   name       = "@"
   value      = linode_instance.prod.ip_address
   type       = "A"
-  ttl        = 1
-  proxied    = true
+  ttl        = 120
 }
 
 resource "cloudflare_record" "splat" {
@@ -43,7 +30,53 @@ resource "cloudflare_record" "splat" {
   value      = linode_instance.prod.ip_address
   type       = "A"
   ttl        = 1
-  proxied    = true
+}
+
+# resource "cloudflare_record" "root6" {
+#   depends_on = [
+#     linode_instance.prod,
+#     cloudflare_record.functionalidiot_com_ns1,
+#     cloudflare_record.functionalidiot_com_ns2 ]
+#   zone_id    = var.cloudflare_functionalidiot_zoneid
+#   name       = "@"
+#   value      = local.ipv6
+#   type       = "AAAA"
+#   ttl        = 120
+# }
+
+# resource "cloudflare_record" "splat6" {
+#   depends_on = [
+#     linode_instance.prod,
+#     cloudflare_record.functionalidiot_com_ns1,
+#     cloudflare_record.functionalidiot_com_ns2 ]
+#   zone_id    = var.cloudflare_functionalidiot_zoneid
+#   name       = "*"
+#   value      = local.ipv6
+#   type       = "AAAA"
+#   ttl        = 1
+#   proxied    = true
+# }
+
+resource "cloudflare_record" "www" {
+  depends_on = [
+    cloudflare_record.root,
+    cloudflare_record.splat ]
+  zone_id    = var.cloudflare_functionalidiot_zoneid
+  name       = "www"
+  value      = "functionalidiot.com"
+  type       = "CNAME"
+  ttl        = 120
+}
+
+resource "cloudflare_record" "git" {
+  depends_on = [
+    cloudflare_record.root,
+    cloudflare_record.splat ]
+  zone_id    = var.cloudflare_functionalidiot_zoneid
+  name       = "git"
+  value      = "functionalidiot.com"
+  type       = "CNAME"
+  ttl        = 120
 }
 
 resource "cloudflare_record" "functionalidiot_com_ns1" {
@@ -60,8 +93,9 @@ resource "cloudflare_record" "functionalidiot_com_ns2" {
   type       = "NS"
 }
 
-resource "null_resource" "functionalidiot_com_setup" {
+resource "null_resource" "functionalidiot_com_setup_new_gitea" {
   depends_on = [ null_resource.post_setup ]
+  count      = fileexists("${path.module}/attic/var-lib-gitea.tar") ? 0 : 1
   connection {
     host        = linode_instance.prod.ip_address
     user        = "root"
@@ -74,18 +108,107 @@ resource "null_resource" "functionalidiot_com_setup" {
   provisioner "remote-exec" {
     inline = [<<FIN
 install -m755 /tmp/setup_gitea.sh /usr/local/bin/setup_gitea
-rm /tmp/setup_gitea.sh
-apk add gitea
+
+rm -f /tmp/setup_gitea.sh
+
 rc-update add gitea default
+
 skey=$(su - gitea -c "gitea generate secret SECRET_KEY")
 itoken=$(su - gitea -c "gitea generate secret INTERNAL_TOKEN")
+
 SECRET_KEY=$skey INTERNAL_TOKEN=$itoken  /usr/local/bin/setup_gitea
-chown gitea:www-data /var/lib/gitea/db/gitea.db
+
 rc-service gitea restart
+
+sleep 3
+
+chown gitea:www-data /var/lib/gitea/db/gitea.db
+
 su - gitea -c "gitea migrate --config /etc/gitea/app.ini"
-su - gitea -c "gitea admin create-user --username test --password test --email spam@whatever.mitchty.com --config /etc/gitea/app.ini"
+
 su - gitea -c "gitea admin create-user --username mitch --password ${var.gitea_db_passwd} --email spam@mitchty.com --admin --config /etc/gitea/app.ini"
 FIN
     ]
   }
 }
+
+resource "null_resource" "functionalidiot_com_setup_saved_uacme" {
+  depends_on = [ null_resource.post_setup ]
+  count      = fileexists("${path.module}/attic/etc-ssl-uacme.tar") ? 1 : 0
+  connection {
+    host        = linode_instance.prod.ip_address
+    user        = "root"
+    private_key = file("~/.ssh/id_rsa")
+  }
+  provisioner "file" {
+    source      = "etc-ssl-uacme.tar"
+    destination = "/tmp/etc-ssl-uacme.tar"
+  }
+  # TODO: Finish post untar setup
+  provisioner "remote-exec" {
+    inline = [<<FIN
+cd /
+tar xvf /tmp/etc-ssl-uacme.tar
+FIN
+    ]
+  }
+}
+
+resource "null_resource" "functionalidiot_com_setup_saved_gitea" {
+  depends_on = [ null_resource.post_setup ]
+  count      = fileexists("${path.module}/attic/var-lib-gitea.tar") ? 1 : 0
+  connection {
+    host        = linode_instance.prod.ip_address
+    user        = "root"
+    private_key = file("~/.ssh/id_rsa")
+  }
+  provisioner "file" {
+    source      = "var-lib-gitea.tar"
+    destination = "/tmp/var-lib-gitea.tar"
+  }
+  # TODO: Finish post untar setup
+  provisioner "remote-exec" {
+    inline = [<<FIN
+cd /
+tar xvf /tmp/var-lib-gitea.tar
+rc-update add gitea default
+rc-service gitea restart
+FIN
+    ]
+  }
+}
+
+resource "null_resource" "functionalidiot_com_setup_new_nginx" {
+  depends_on = [
+    null_resource.post_setup,
+    null_resource.functionalidiot_com_setup_saved_gitea,
+    null_resource.functionalidiot_com_setup_saved_uacme
+  ]
+  connection {
+    host        = linode_instance.prod.ip_address
+    user        = "root"
+    private_key = file("~/.ssh/id_rsa")
+  }
+  provisioner "file" {
+    source      = "http-default.conf"
+    destination = "/tmp/http-default.conf"
+  }
+  provisioner "file" {
+    source      = "https-functionalidiot.com.conf"
+    destination = "/tmp/https-functionalidiot.com.conf"
+  }
+  provisioner "remote-exec" {
+    inline = [<<FIN
+[ -e /etc/nginx/conf.d/default.conf ] && mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf.disable
+install -m644 /tmp/http-default.conf /etc/nginx/conf.d/http-default.conf
+install -m644 /tmp/https-functionalidiot.com.conf /etc/nginx/conf.d/https-functionalidiot.com.conf
+rm -fr /tmp/*.conf
+
+install -dm755 /var/www/default/htdocs /var/www/.well-known/acme-challenge
+echo todo write more stuff > /var/www/default/htdocs/index.html
+
+rc-service nginx restart
+FIN
+    ]
+  }
+}

http-default.conf

@@ -0,0 +1,13 @@
+# Redirect all http traffic
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+
+    location ^~ /.well-known/acme-challenge {
+        alias /var/www/.well-known/acme-challenge;
+    }
+}

https-functionalidiot.com.conf

@@ -0,0 +1,22 @@
+server {
+    listen 443 ssl default_server;
+    listen [::]:443 ssl default_server;
+    # TODO: fixme
+    # server_name functionalidiot.com;
+    server_name _;
+#    server_name_in_redirect off;
+    root  /var/www/default/htdocs;
+
+    ssl_certificate /etc/ssl/uacme/functionalidiot.com/cert.pem;
+    ssl_certificate_key /etc/ssl/uacme/private/functionalidiot.com/key.pem;
+    ssl_stapling on;
+    ssl_protocols TLSv1.2;
+
+    location / {
+        proxy_pass http://unix:/var/lib/gitea/unix-domain-socket:/;
+    }
+
+    location ^~ /.well-known/acme-challenge {
+        alias /var/www/.well-known/acme-challenge;
+    }
+}

setup_gitea.sh

@@ -4,7 +4,9 @@ gitea_ini=/etc/gitea/app.ini
 
 # We want to listen on 127.0.0.1 instead of 0.0.0.0 for now
 if ! grep HTTP_ADDR $gitea_ini; then
-  sed -i -e '/\[server\]/a HTTP_ADDR=127.0.0.1' $gitea_ini
+    sed -i -e '/\[server\]/a HTTP_ADDR = /var/lib/gitea/unix-domain-socket' $gitea_ini
+    sed -i -e '/\[server\]/a PROTOCOL = unix' $gitea_ini
+    sed -i -e '/\[server\]/a UNIX_SOCKET_PERMISSION = 666' $gitea_ini
 fi
 
 if ! grep OFFLINE_MODE $gitea_ini; then