Add mitchty.com dns setup

.gitignore

@@ -2,3 +2,4 @@ terraform.tfvars
 .terraform
 terraform.tfstate
 terraform.tfstate.backup
+attic

GNUmakefile

@@ -2,6 +2,7 @@ TF:=terraform
 SSH:=ssh
 USER_SSH_OPTS:=
 SSH_OPTS:=-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no $(USER_SSH_OPTS)
+RUN_EPOCH:=$(shell date +%s)
 
 .PHONY: all
 all: up
@@ -20,3 +21,29 @@ down:
 .PHONY: ssh
 ssh:
 	$(SSH) $(SSH_OPTS) root@`$(TF) output ipv4`
+
+attic:
+	install -dm755 $@
+
+.PHONY: backup
+backup: backup-history backup-ssl backup-gitea backup-syncthing
+
+.PHONY: backup-history
+backup-history: attic
+	-$(SSH) $(SSH_OPTS) root@`$(TF) output ipv4` 'cat /root/.ash_history' > attic/.ash_history.$(RUN_EPOCH)
+	[ -z attic/.ash_history.$(RUN_EPOCH) ] && rm attic/.ash_history.$(RUN_EPOCH) || ln -f attic/.ash_history.$(RUN_EPOCH) attic/.ash_history
+
+.PHONY: backup-gitea
+backup-gitea: attic
+	$(SSH) $(SSH_OPTS) root@`$(TF) output ipv4` 'tar --exclude /var/lib/gitea/unix-domain-socket -cvJf - /var/lib/gitea /etc/gitea' > attic/gitea.txz.$(RUN_EPOCH)
+	ln -f attic/gitea.txz.$(RUN_EPOCH) attic/gitea.txz
+
+.PHONY: backup-ssl
+backup-ssl: attic
+	$(SSH) $(SSH_OPTS) root@`$(TF) output ipv4` 'tar cvJf - /etc/ssl/uacme' > attic/uacme.txz.$(RUN_EPOCH)
+	ln -f attic/uacme.txz.$(RUN_EPOCH) attic/uacme.txz
+
+.PHONY: backup-syncthing
+backup-syncthing: attic
+	$(SSH) $(SSH_OPTS) root@`$(TF) output ipv4` 'tar cvJf - /var/lib/syncthing' > attic/syncthing.txz.$(RUN_EPOCH)
+	ln -f attic/syncthing.txz.$(RUN_EPOCH) attic/syncthing.txz

dns-functionalidiot.com.tf

@@ -0,0 +1,192 @@
+variable "cloudflare_functionalidiot_com_zoneid" {
+  type = string
+}
+
+resource "cloudflare_record" "ns1_functionalidiot_com" {
+  zone_id    = var.cloudflare_functionalidiot_com_zoneid
+  name       = "@"
+  value      = "mitch.ns.cloudflare.com"
+  type       = "NS"
+}
+
+resource "cloudflare_record" "ns2_functionalidiot_com" {
+  zone_id    = var.cloudflare_functionalidiot_com_zoneid
+  name       = "@"
+  value      = "tegan.ns.cloudflare.com"
+  type       = "NS"
+}
+
+resource "cloudflare_record" "root_functionalidiot_com" {
+  depends_on = [
+    linode_instance.prod,
+    cloudflare_record.ns1_functionalidiot_com,
+    cloudflare_record.ns2_functionalidiot_com ]
+  zone_id    = var.cloudflare_functionalidiot_com_zoneid
+  name       = "@"
+  value      = linode_instance.prod.ip_address
+  type       = "A"
+  ttl        = local.dns_ttl
+}
+
+resource "cloudflare_record" "splat_functionalidiot_com" {
+  depends_on = [
+    linode_instance.prod,
+    cloudflare_record.ns1_functionalidiot_com,
+    cloudflare_record.ns2_functionalidiot_com ]
+  zone_id    = var.cloudflare_functionalidiot_com_zoneid
+  name       = "*"
+  value      = linode_instance.prod.ip_address
+  type       = "A"
+  ttl        = local.dns_ttl
+}
+
+# resource "cloudflare_record" "root6_functionalidiot_com" {
+#   depends_on = [
+#     linode_instance.prod,
+#     cloudflare_record.ns1_functionalidiot_com,
+#     cloudflare_record.ns2_functionalidiot_com ]
+#   zone_id    = var.cloudflare_functionalidiot_com_zoneid
+#   name       = "@"
+#   value      = local.ipv6
+#   type       = "AAAA"
+#   ttl        = local.dns_ttl
+# }
+
+# resource "cloudflare_record" "splat6_functionalidiot_com" {
+#   depends_on = [
+#     linode_instance.prod,
+#     cloudflare_record.ns1_functionalidiot_com,
+#     cloudflare_record.ns2_functionalidiot_com ]
+#   zone_id    = var.cloudflare_functionalidiot_com_zoneid
+#   name       = "*"
+#   value      = local.ipv6
+#   type       = "AAAA"
+#   ttl        = local.dns_ttl
+#   proxied    = true
+# }
+
+resource "cloudflare_record" "www_functionalidiot_com" {
+  depends_on = [
+    cloudflare_record.root_functionalidiot_com,
+    cloudflare_record.splat_functionalidiot_com ]
+  zone_id    = var.cloudflare_functionalidiot_com_zoneid
+  name       = "www"
+  value      = "functionalidiot.com"
+  type       = "CNAME"
+  ttl        = local.dns_ttl
+}
+
+resource "cloudflare_record" "git_functionalidiot_com" {
+  depends_on = [
+    cloudflare_record.root_functionalidiot_com,
+    cloudflare_record.splat_functionalidiot_com ]
+  zone_id    = var.cloudflare_functionalidiot_com_zoneid
+  name       = "git"
+  value      = "functionalidiot.com"
+  type       = "CNAME"
+  ttl        = local.dns_ttl
+}
+
+# MX record setup for fastmail dkim/spf on root and all subdomains
+resource "cloudflare_record" "mx_cname_1_functionalidiot_com" {
+  depends_on = [
+    cloudflare_record.root_functionalidiot_com,
+    cloudflare_record.splat_functionalidiot_com ]
+  zone_id    = var.cloudflare_functionalidiot_com_zoneid
+  name       = "fm1._domainkey"
+  value      = "fm1.functionalidiot.com.dkim.fmhosted.com"
+  type       = "CNAME"
+  ttl        = local.dns_ttl
+}
+
+resource "cloudflare_record" "mx_cname_2_functionalidiot_com" {
+  depends_on = [
+    cloudflare_record.root_functionalidiot_com,
+    cloudflare_record.splat_functionalidiot_com ]
+  zone_id    = var.cloudflare_functionalidiot_com_zoneid
+  name       = "fm2._domainkey"
+  value      = "fm2.functionalidiot.com.dkim.fmhosted.com"
+  type       = "CNAME"
+  ttl        = local.dns_ttl
+}
+
+resource "cloudflare_record" "mx_cname_3_functionalidiot_com" {
+  depends_on = [
+    cloudflare_record.root_functionalidiot_com,
+    cloudflare_record.splat_functionalidiot_com ]
+  zone_id    = var.cloudflare_functionalidiot_com_zoneid
+  name       = "fm3._domainkey"
+  value      = "fm3.functionalidiot.com.dkim.fmhosted.com"
+  type       = "CNAME"
+  ttl        = local.dns_ttl
+}
+
+resource "cloudflare_record" "mx_10_root_functionalidiot_com" {
+  depends_on = [
+    cloudflare_record.root_functionalidiot_com,
+    cloudflare_record.splat_functionalidiot_com ]
+  zone_id  = var.cloudflare_functionalidiot_com_zoneid
+  name     = "@"
+  value    = "in1-smtp.messagingengine.com"
+  type     = "MX"
+  priority = "10"
+  ttl      = local.dns_ttl
+}
+
+resource "cloudflare_record" "mx_20_root_functionalidiot_com" {
+  depends_on = [
+    cloudflare_record.root_functionalidiot_com,
+    cloudflare_record.splat_functionalidiot_com ]
+  zone_id  = var.cloudflare_functionalidiot_com_zoneid
+  name     = "@"
+  value    = "in2-smtp.messagingengine.com"
+  type     = "MX"
+  priority = "20"
+  ttl      = local.dns_ttl
+}
+
+resource "cloudflare_record" "mx-10-splat_functionalidiot_com" {
+  depends_on = [
+    cloudflare_record.root_functionalidiot_com,
+    cloudflare_record.splat_functionalidiot_com ]
+  zone_id  = var.cloudflare_functionalidiot_com_zoneid
+  name     = "*"
+  value    = "in1-smtp.messagingengine.com"
+  type     = "MX"
+  priority = "10"
+  ttl      = local.dns_ttl
+}
+
+resource "cloudflare_record" "mx_20_splat_functionalidiot_com" {
+  depends_on = [
+    cloudflare_record.root_functionalidiot_com,
+    cloudflare_record.splat_functionalidiot_com ]
+  zone_id  = var.cloudflare_functionalidiot_com_zoneid
+  name     = "*"
+  value    = "in2-smtp.messagingengine.com"
+  type     = "MX"
+  priority = "20"
+  ttl      = local.dns_ttl
+}
+
+resource "cloudflare_record" "txt_mx_root_functionalidiot_com" {
+  depends_on = [
+    cloudflare_record.root_functionalidiot_com,
+    cloudflare_record.splat_functionalidiot_com ]
+  zone_id  = var.cloudflare_functionalidiot_com_zoneid
+  name     = "@"
+  value    = "v=spf1 include:spf.messagingengine.com ?all"
+  type     = "TXT"
+  ttl      = local.dns_ttl
+}
+
+resource "cloudflare_record" "txt_mx_splat_functionalidiot_com" {
+  depends_on = [
+    cloudflare_record.root_functionalidiot_com,
+    cloudflare_record.splat_functionalidiot_com ]
+  zone_id  = var.cloudflare_functionalidiot_com_zoneid
+  name     = "*"
+  value    = "v=spf1 include:spf.messagingengine.com ?all"
+  type     = "TXT"
+  ttl      = local.dns_ttl
+}

dns-mitchty.com.tf

@@ -0,0 +1,192 @@
+variable "cloudflare_mitchty_com_zoneid" {
+  type = string
+}
+
+resource "cloudflare_record" "ns1_mitchty_com" {
+  zone_id    = var.cloudflare_mitchty_com_zoneid
+  name       = "@"
+  value      = "mitch.ns.cloudflare.com"
+  type       = "NS"
+}
+
+resource "cloudflare_record" "ns2_mitchty_com" {
+  zone_id    = var.cloudflare_mitchty_com_zoneid
+  name       = "@"
+  value      = "tegan.ns.cloudflare.com"
+  type       = "NS"
+}
+
+resource "cloudflare_record" "root_mitchty_com" {
+  depends_on = [
+    linode_instance.prod,
+    cloudflare_record.ns1_mitchty_com,
+    cloudflare_record.ns2_mitchty_com ]
+  zone_id    = var.cloudflare_mitchty_com_zoneid
+  name       = "@"
+  value      = linode_instance.prod.ip_address
+  type       = "A"
+  ttl        = local.dns_ttl
+}
+
+resource "cloudflare_record" "splat_mitchty_com" {
+  depends_on = [
+    linode_instance.prod,
+    cloudflare_record.ns1_mitchty_com,
+    cloudflare_record.ns2_mitchty_com ]
+  zone_id    = var.cloudflare_mitchty_com_zoneid
+  name       = "*"
+  value      = linode_instance.prod.ip_address
+  type       = "A"
+  ttl        = local.dns_ttl
+}
+
+# resource "cloudflare_record" "root6_mitchty_com" {
+#   depends_on = [
+#     linode_instance.prod,
+#     cloudflare_record.ns1_mitchty_com,
+#     cloudflare_record.ns2_mitchty_com ]
+#   zone_id    = var.cloudflare_mitchty_com_zoneid
+#   name       = "@"
+#   value      = local.ipv6
+#   type       = "AAAA"
+#   ttl        = local.dns_ttl
+# }
+
+# resource "cloudflare_record" "splat6_mitchty_com" {
+#   depends_on = [
+#     linode_instance.prod,
+#     cloudflare_record.ns1_mitchty_com,
+#     cloudflare_record.ns2_mitchty_com ]
+#   zone_id    = var.cloudflare_mitchty_com_zoneid
+#   name       = "*"
+#   value      = local.ipv6
+#   type       = "AAAA"
+#   ttl        = local.dns_ttl
+#   proxied    = true
+# }
+
+resource "cloudflare_record" "www_mitchty_com" {
+  depends_on = [
+    cloudflare_record.root_mitchty_com,
+    cloudflare_record.splat_mitchty_com ]
+  zone_id    = var.cloudflare_mitchty_com_zoneid
+  name       = "www"
+  value      = "mitchty.com"
+  type       = "CNAME"
+  ttl        = local.dns_ttl
+}
+
+resource "cloudflare_record" "git_mitchty_com" {
+  depends_on = [
+    cloudflare_record.root_mitchty_com,
+    cloudflare_record.splat_mitchty_com ]
+  zone_id    = var.cloudflare_mitchty_com_zoneid
+  name       = "git"
+  value      = "mitchty.com"
+  type       = "CNAME"
+  ttl        = local.dns_ttl
+}
+
+# MX record setup for fastmail dkim/spf on root and all subdomains
+resource "cloudflare_record" "mx_cname_1_mitchty_com" {
+  depends_on = [
+    cloudflare_record.root_mitchty_com,
+    cloudflare_record.splat_mitchty_com ]
+  zone_id    = var.cloudflare_mitchty_com_zoneid
+  name       = "fm1._domainkey"
+  value      = "fm1.mitchty.com.dkim.fmhosted.com"
+  type       = "CNAME"
+  ttl        = local.dns_ttl
+}
+
+resource "cloudflare_record" "mx_cname_2_mitchty_com" {
+  depends_on = [
+    cloudflare_record.root_mitchty_com,
+    cloudflare_record.splat_mitchty_com ]
+  zone_id    = var.cloudflare_mitchty_com_zoneid
+  name       = "fm2._domainkey"
+  value      = "fm2.mitchty.com.dkim.fmhosted.com"
+  type       = "CNAME"
+  ttl        = local.dns_ttl
+}
+
+resource "cloudflare_record" "mx_cname_3_mitchty_com" {
+  depends_on = [
+    cloudflare_record.root_mitchty_com,
+    cloudflare_record.splat_mitchty_com ]
+  zone_id    = var.cloudflare_mitchty_com_zoneid
+  name       = "fm3._domainkey"
+  value      = "fm3.mitchty.com.dkim.fmhosted.com"
+  type       = "CNAME"
+  ttl        = local.dns_ttl
+}
+
+resource "cloudflare_record" "mx_10_root_mitchty_com" {
+  depends_on = [
+    cloudflare_record.root_mitchty_com,
+    cloudflare_record.splat_mitchty_com ]
+  zone_id  = var.cloudflare_mitchty_com_zoneid
+  name     = "@"
+  value    = "in1-smtp.messagingengine.com"
+  type     = "MX"
+  priority = "10"
+  ttl      = local.dns_ttl
+}
+
+resource "cloudflare_record" "mx_20_root_mitchty_com" {
+  depends_on = [
+    cloudflare_record.root_mitchty_com,
+    cloudflare_record.splat_mitchty_com ]
+  zone_id  = var.cloudflare_mitchty_com_zoneid
+  name     = "@"
+  value    = "in2-smtp.messagingengine.com"
+  type     = "MX"
+  priority = "20"
+  ttl      = local.dns_ttl
+}
+
+resource "cloudflare_record" "mx_10_splat_mitchty_com" {
+  depends_on = [
+    cloudflare_record.root_mitchty_com,
+    cloudflare_record.splat_mitchty_com ]
+  zone_id  = var.cloudflare_mitchty_com_zoneid
+  name     = "*"
+  value    = "in1-smtp.messagingengine.com"
+  type     = "MX"
+  priority = "10"
+  ttl      = local.dns_ttl
+}
+
+resource "cloudflare_record" "mx_20_splat_mitchty_com" {
+  depends_on = [
+    cloudflare_record.root_mitchty_com,
+    cloudflare_record.splat_mitchty_com ]
+  zone_id  = var.cloudflare_mitchty_com_zoneid
+  name     = "*"
+  value    = "in2-smtp.messagingengine.com"
+  type     = "MX"
+  priority = "20"
+  ttl      = local.dns_ttl
+}
+
+resource "cloudflare_record" "txt_mx_root_mitchty_com" {
+  depends_on = [
+    cloudflare_record.root_mitchty_com,
+    cloudflare_record.splat_mitchty_com ]
+  zone_id  = var.cloudflare_mitchty_com_zoneid
+  name     = "@"
+  value    = "v=spf1 include:spf.messagingengine.com ?all"
+  type     = "TXT"
+  ttl      = local.dns_ttl
+}
+
+resource "cloudflare_record" "txt_mx_splat_mitchty_com" {
+  depends_on = [
+    cloudflare_record.root_mitchty_com,
+    cloudflare_record.splat_mitchty_com ]
+  zone_id  = var.cloudflare_mitchty_com_zoneid
+  name     = "*"
+  value    = "v=spf1 include:spf.messagingengine.com ?all"
+  type     = "TXT"
+  ttl      = local.dns_ttl
+}

dns.tf

@@ -0,0 +1,11 @@
+# Dns defaults
+
+variable "short_dns_ttl" {
+  type        = bool
+  default     = true
+  description = "Whether to set short dns ttl's or not."
+}
+
+locals {
+  dns_ttl = var.short_dns_ttl ? 120 : 43200
+}

functionalidiot.com.tf

@@ -4,64 +4,9 @@ variable "gitea_db_passwd" {
   type = string
 }
 
-variable "cloudflare_functionalidiot_zoneid" {
-  type = string
-}
-
-resource "cloudflare_record" "www" {
-  depends_on = [
-    cloudflare_record.root,
-    cloudflare_record.splat ]
-  zone_id    = var.cloudflare_functionalidiot_zoneid
-  name       = "www"
-  value      = "functionalidiot.com"
-  type       = "CNAME"
-  ttl        = 1
-  proxied    = true
-}
-
-resource "cloudflare_record" "root" {
-  depends_on = [
-    linode_instance.prod,
-    cloudflare_record.functionalidiot_com_ns1,
-    cloudflare_record.functionalidiot_com_ns2 ]
-  zone_id    = var.cloudflare_functionalidiot_zoneid
-  name       = "@"
-  value      = linode_instance.prod.ip_address
-  type       = "A"
-  ttl        = 1
-  proxied    = true
-}
-
-resource "cloudflare_record" "splat" {
-  depends_on = [
-    linode_instance.prod,
-    cloudflare_record.functionalidiot_com_ns1,
-    cloudflare_record.functionalidiot_com_ns2 ]
-  zone_id    = var.cloudflare_functionalidiot_zoneid
-  name       = "*"
-  value      = linode_instance.prod.ip_address
-  type       = "A"
-  ttl        = 1
-  proxied    = true
-}
-
-resource "cloudflare_record" "functionalidiot_com_ns1" {
-  zone_id    = var.cloudflare_functionalidiot_zoneid
-  name       = "@"
-  value      = "mitch.ns.cloudflare.com"
-  type       = "NS"
-}
-
-resource "cloudflare_record" "functionalidiot_com_ns2" {
-  zone_id    = var.cloudflare_functionalidiot_zoneid
-  name       = "@"
-  value      = "tegan.ns.cloudflare.com"
-  type       = "NS"
-}
-
-resource "null_resource" "functionalidiot_com_setup" {
-  depends_on = [ null_resource.post_setup ]
+resource "null_resource" "functionalidiot_com_setup_new_gitea" {
+  depends_on = [ null_resource.gitea_install ]
+  count      = fileexists("${path.module}/attic/gitea.txz") ? 0 : 1
   connection {
     host        = linode_instance.prod.ip_address
     user        = "root"
@@ -74,17 +19,115 @@ resource "null_resource" "functionalidiot_com_setup" {
   provisioner "remote-exec" {
     inline = [<<FIN
 install -m755 /tmp/setup_gitea.sh /usr/local/bin/setup_gitea
-rm /tmp/setup_gitea.sh
-apk add gitea
+
+rm -f /tmp/setup_gitea.sh
+
 rc-update add gitea default
+
 skey=$(su - gitea -c "gitea generate secret SECRET_KEY")
 itoken=$(su - gitea -c "gitea generate secret INTERNAL_TOKEN")
+
 SECRET_KEY=$skey INTERNAL_TOKEN=$itoken  /usr/local/bin/setup_gitea
-chown gitea:www-data /var/lib/gitea/db/gitea.db
+
 rc-service gitea restart
+
+sleep 3
+
+chown gitea:www-data /var/lib/gitea/db/gitea.db
+
 su - gitea -c "gitea migrate --config /etc/gitea/app.ini"
-su - gitea -c "gitea admin create-user --username test --password test --email spam@whatever.mitchty.com --config /etc/gitea/app.ini"
-su - gitea -c "gitea admin create-user --username mitch --password ${var.gitea_db_passwd} --email spam@mitchty.com --admin --config /etc/gitea/app.ini"
+
+su - gitea -c "gitea admin create-user --username mitchty --password ${var.gitea_db_passwd} --email git@functionalidiot.com --admin --config /etc/gitea/app.ini"
+FIN
+    ]
+  }
+}
+
+resource "null_resource" "functionalidiot_com_setup_saved_gitea" {
+  depends_on = [ null_resource.gitea_install ]
+  count      = fileexists("${path.module}/attic/gitea.txz") ? 1 : 0
+  connection {
+    host        = linode_instance.prod.ip_address
+    user        = "root"
+    private_key = file("~/.ssh/id_rsa")
+  }
+  provisioner "file" {
+    source      = "${path.module}/attic/gitea.txz"
+    destination = "/tmp/gitea.txz"
+  }
+  # TODO: Finish post untar setup
+  provisioner "remote-exec" {
+    inline = [<<FIN
+cd /
+tar xvJf /tmp/gitea.txz
+rc-update add gitea default
+rc-service gitea restart
+FIN
+    ]
+  }
+}
+
+resource "null_resource" "functionalidiot_com_setup_saved_uacme" {
+  depends_on = [ null_resource.uacme_install ]
+  count      = fileexists("${path.module}/attic/uacme.txz") ? 1 : 0
+  connection {
+    host        = linode_instance.prod.ip_address
+    user        = "root"
+    private_key = file("~/.ssh/id_rsa")
+  }
+  provisioner "file" {
+    source      = "${path.module}/attic/uacme.txz"
+    destination = "/tmp/uacme.txz"
+  }
+  # TODO: Finish post untar setup
+  provisioner "remote-exec" {
+    inline = [<<FIN
+cd /
+tar xvJf /tmp/uacme.txz
+FIN
+    ]
+  }
+}
+
+# FIXME: This nginx setup isn't idempotent if its a new setup vs saved
+# uacme ssl setup.
+#
+# Maybe use the dns uacme crap instead of this stupid http bs?
+#
+# https://www.terraform.io/docs/providers/acme/r/certificate.html
+# https://www.terraform.io/docs/providers/acme/dns_providers/cloudflare.html
+resource "null_resource" "functionalidiot_com_setup_new_nginx" {
+  depends_on = [
+    null_resource.nginx_install,
+    null_resource.functionalidiot_com_setup_new_gitea,
+    null_resource.functionalidiot_com_setup_saved_gitea,
+    null_resource.functionalidiot_com_setup_saved_uacme,
+    null_resource.functionalidiot_com_setup_saved_uacme
+  ]
+  connection {
+    host        = linode_instance.prod.ip_address
+    user        = "root"
+    private_key = file("~/.ssh/id_rsa")
+  }
+  provisioner "file" {
+    source      = "http-default.conf"
+    destination = "/tmp/http-default.conf"
+  }
+  provisioner "file" {
+    source      = "https-functionalidiot.com.conf"
+    destination = "/tmp/https-functionalidiot.com.conf"
+  }
+  provisioner "remote-exec" {
+    inline = [<<FIN
+[ -e /etc/nginx/conf.d/default.conf ] && mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf.disable
+install -m644 /tmp/http-default.conf /etc/nginx/conf.d/http-default.conf
+install -m644 /tmp/https-functionalidiot.com.conf /etc/nginx/conf.d/https-functionalidiot.com.conf
+rm -fr /tmp/*.conf
+
+install -dm755 /var/www/default/htdocs /var/www/.well-known/acme-challenge
+echo todo write more stuff > /var/www/default/htdocs/index.html
+
+rc-service nginx restart
 FIN
     ]
   }

http-default.conf

@@ -0,0 +1,13 @@
+# Redirect all http traffic
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+
+    location ^~ /.well-known/acme-challenge {
+        alias /var/www/.well-known/acme-challenge;
+    }
+}

https-functionalidiot.com.conf

@@ -0,0 +1,40 @@
+server {
+    listen 443 ssl default_server;
+    listen [::]:443 ssl default_server;
+    server_name functionalidiot.com;
+    root  /var/www/default/htdocs;
+    index index.htm index.html;
+
+    ssl_certificate /etc/ssl/uacme/functionalidiot.com/cert.pem;
+    ssl_certificate_key /etc/ssl/uacme/private/functionalidiot.com/key.pem;
+    ssl_stapling on;
+    ssl_protocols TLSv1.2;
+
+    location / {
+        try_files $uri $uri/ =404;
+    }
+
+    location ^~ /.well-known/acme-challenge {
+        alias /var/www/.well-known/acme-challenge;
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+
+    server_name git.functionalidiot.com;
+
+    ssl_certificate /etc/ssl/uacme/functionalidiot.com/cert.pem;
+    ssl_certificate_key /etc/ssl/uacme/private/functionalidiot.com/key.pem;
+    ssl_stapling on;
+    ssl_protocols TLSv1.2;
+
+    location / {
+        proxy_pass http://unix:/var/lib/gitea/unix-domain-socket:/;
+    }
+
+    location ^~ /.well-known/acme-challenge {
+        alias /var/www/.well-known/acme-challenge;
+    }
+}

main.tf

@@ -18,5 +18,13 @@ resource "linode_instance" "prod" {
 }
 
 output "ipv4" {
-  value = "${linode_instance.prod.ip_address}"
+  value = linode_instance.prod.ip_address
+}
+
+locals {
+  ipv6 = split("/", linode_instance.prod.ipv6)[0]
+}
+
+output "ipv6" {
+  value = local.ipv6
 }

post_setup.tf

@@ -9,12 +9,58 @@ resource "null_resource" "post_setup" {
     inline = [<<FIN
 apk update
 apk upgrade
-apk add nginx muacme gitea iproute2 sqlite bind-tools
-rc-update add nginx default
-rc-service nginx restart
+apk add iproute2 sqlite bind-tools tar xz
 sed -i -e 's/AllowTcpForwarding .*/AllowTcpForwarding yes/g' /etc/ssh/sshd_config
 rc-service sshd restart
 FIN
     ]
   }
 }
+
+resource "null_resource" "nginx_install" {
+  depends_on = [ null_resource.post_setup ]
+  connection {
+    host        = linode_instance.prod.ip_address
+    user        = "root"
+    private_key = file("~/.ssh/id_rsa")
+  }
+  provisioner "remote-exec" {
+    inline = [<<FIN
+flock -x /tmp/apk -c 'apk add nginx'
+apk add nginx muacme gitea iproute2 sqlite bind-tools tar xz
+rc-update add nginx default
+rc-service nginx restart
+FIN
+    ]
+  }
+}
+
+resource "null_resource" "uacme_install" {
+  depends_on = [ null_resource.post_setup ]
+  connection {
+    host        = linode_instance.prod.ip_address
+    user        = "root"
+    private_key = file("~/.ssh/id_rsa")
+  }
+  provisioner "remote-exec" {
+    inline = [<<FIN
+flock -x /tmp/apk -c 'apk add muacme'
+FIN
+    ]
+  }
+}
+
+resource "null_resource" "gitea_install" {
+  depends_on = [ null_resource.post_setup ]
+  connection {
+    host        = linode_instance.prod.ip_address
+    user        = "root"
+    private_key = file("~/.ssh/id_rsa")
+  }
+  provisioner "remote-exec" {
+    inline = [<<FIN
+flock -x /tmp/apk -c 'apk add gitea'
+FIN
+    ]
+  }
+}

setup_gitea.sh

@@ -4,7 +4,13 @@ gitea_ini=/etc/gitea/app.ini
 
 # We want to listen on 127.0.0.1 instead of 0.0.0.0 for now
 if ! grep HTTP_ADDR $gitea_ini; then
-  sed -i -e '/\[server\]/a HTTP_ADDR=127.0.0.1' $gitea_ini
+    sed -i -e '/\[server\]/a HTTP_ADDR = /var/lib/gitea/unix-domain-socket' $gitea_ini
+    sed -i -e '/\[server\]/a PROTOCOL = unix' $gitea_ini
+    sed -i -e '/\[server\]/a UNIX_SOCKET_PERMISSION = 666' $gitea_ini
+    sed -i -e '/\[server\]/a START_SSH_SERVER = true' $gitea_ini
+    sed -i -e '/\[server\]/a SSH_DOMAIN = git.functionalidiot.com' $gitea_ini
+    sed -i -e '/\[server\]/a SSH_PORT = 2222' $gitea_ini
+    sed -i -e '/\[server\]/a SSH_LISTEN_PORT = 2222' $gitea_ini
 fi
 
 if ! grep OFFLINE_MODE $gitea_ini; then
@@ -14,7 +20,7 @@ fi
 
 # Change the gitea APP_NAME
 if ! grep APP_NAME $gitea_ini; then
-    sed -i -e '/^RUN_MODE.*/a APP_NAME = mitchtys git house' $gitea_ini
+    sed -i -e '/^RUN_MODE.*/a APP_NAME = just a bunch of git repos' $gitea_ini
 fi
 
 # Ensure all new repos are private by default
@@ -74,5 +80,9 @@ ENABLED = false
 [picture]
 DISABLE_GRAVATAR        = false
 ENABLE_FEDERATED_AVATAR = true
+
+[git]
+MAX_GIT_DIFF_LINES           = 20000
+MAX_GIT_DIFF_LINE_CHARACTERS = 100000
 FIN
 fi