site-setup/functionalidiot.com.tf

# gitea is a PITA to automate installation of, watch this pr for when it'll be
# fully setup-able from the cli https://github.com/go-gitea/gitea/issues/9210
variable "gitea_db_passwd" {
  type = string
}

variable "cloudflare_functionalidiot_zoneid" {
  type = string
}

variable "short_dns_ttl" {
  type        = bool
  default     = true
  description = "Whether to set short dns ttl's or not."
}

locals {
  dns_ttl = var.short_dns_ttl ? 120 : 43200
}

resource "cloudflare_record" "root" {
  depends_on = [
    linode_instance.prod,
    cloudflare_record.functionalidiot_com_ns1,
    cloudflare_record.functionalidiot_com_ns2 ]
  zone_id    = var.cloudflare_functionalidiot_zoneid
  name       = "@"
  value      = linode_instance.prod.ip_address
  type       = "A"
  ttl        = local.dns_ttl
}

resource "cloudflare_record" "splat" {
  depends_on = [
    linode_instance.prod,
    cloudflare_record.functionalidiot_com_ns1,
    cloudflare_record.functionalidiot_com_ns2 ]
  zone_id    = var.cloudflare_functionalidiot_zoneid
  name       = "*"
  value      = linode_instance.prod.ip_address
  type       = "A"
  ttl        = local.dns_ttl
}

# resource "cloudflare_record" "root6" {
#   depends_on = [
#     linode_instance.prod,
#     cloudflare_record.functionalidiot_com_ns1,
#     cloudflare_record.functionalidiot_com_ns2 ]
#   zone_id    = var.cloudflare_functionalidiot_zoneid
#   name       = "@"
#   value      = local.ipv6
#   type       = "AAAA"
#   ttl        = local.dns_ttl
# }

# resource "cloudflare_record" "splat6" {
#   depends_on = [
#     linode_instance.prod,
#     cloudflare_record.functionalidiot_com_ns1,
#     cloudflare_record.functionalidiot_com_ns2 ]
#   zone_id    = var.cloudflare_functionalidiot_zoneid
#   name       = "*"
#   value      = local.ipv6
#   type       = "AAAA"
#   ttl        = local.dns_ttl
#   proxied    = true
# }

resource "cloudflare_record" "www" {
  depends_on = [
    cloudflare_record.root,
    cloudflare_record.splat ]
  zone_id    = var.cloudflare_functionalidiot_zoneid
  name       = "www"
  value      = "functionalidiot.com"
  type       = "CNAME"
  ttl        = local.dns_ttl
}

resource "cloudflare_record" "git" {
  depends_on = [
    cloudflare_record.root,
    cloudflare_record.splat ]
  zone_id    = var.cloudflare_functionalidiot_zoneid
  name       = "git"
  value      = "functionalidiot.com"
  type       = "CNAME"
  ttl        = local.dns_ttl
}

# MX record setup for fastmail dkim/spf on root and all subdomains
resource "cloudflare_record" "mx-cname-1" {
  depends_on = [
    cloudflare_record.root,
    cloudflare_record.splat ]
  zone_id    = var.cloudflare_functionalidiot_zoneid
  name       = "fm1._domainkey"
  value      = "fm1.functionalidiot.com.dkim.fmhosted.com"
  type       = "CNAME"
  ttl        = local.dns_ttl
}

resource "cloudflare_record" "mx-cname-2" {
  depends_on = [
    cloudflare_record.root,
    cloudflare_record.splat ]
  zone_id    = var.cloudflare_functionalidiot_zoneid
  name       = "fm2._domainkey"
  value      = "fm2.functionalidiot.com.dkim.fmhosted.com"
  type       = "CNAME"
  ttl        = local.dns_ttl
}

resource "cloudflare_record" "mx-cname-3" {
  depends_on = [
    cloudflare_record.root,
    cloudflare_record.splat ]
  zone_id    = var.cloudflare_functionalidiot_zoneid
  name       = "fm3._domainkey"
  value      = "fm3.functionalidiot.com.dkim.fmhosted.com"
  type       = "CNAME"
  ttl        = local.dns_ttl
}

resource "cloudflare_record" "mx-10-root" {
  depends_on = [
    cloudflare_record.root,
    cloudflare_record.splat ]
  zone_id  = var.cloudflare_functionalidiot_zoneid
  name     = "@"
  value    = "in1-smtp.messagingengine.com"
  type     = "MX"
  priority = "10"
  ttl      = local.dns_ttl
}

resource "cloudflare_record" "mx-20-root" {
  depends_on = [
    cloudflare_record.root,
    cloudflare_record.splat ]
  zone_id  = var.cloudflare_functionalidiot_zoneid
  name     = "@"
  value    = "in2-smtp.messagingengine.com"
  type     = "MX"
  priority = "20"
  ttl      = local.dns_ttl
}

resource "cloudflare_record" "mx-10-splat" {
  depends_on = [
    cloudflare_record.root,
    cloudflare_record.splat ]
  zone_id  = var.cloudflare_functionalidiot_zoneid
  name     = "*"
  value    = "in1-smtp.messagingengine.com"
  type     = "MX"
  priority = "10"
  ttl      = local.dns_ttl
}

resource "cloudflare_record" "mx-20-splat" {
  depends_on = [
    cloudflare_record.root,
    cloudflare_record.splat ]
  zone_id  = var.cloudflare_functionalidiot_zoneid
  name     = "*"
  value    = "in2-smtp.messagingengine.com"
  type     = "MX"
  priority = "20"
  ttl      = local.dns_ttl
}

resource "cloudflare_record" "txt-mx-root" {
  depends_on = [
    cloudflare_record.root,
    cloudflare_record.splat ]
  zone_id  = var.cloudflare_functionalidiot_zoneid
  name     = "@"
  value    = "v=spf1 include:spf.messagingengine.com ?all"
  type     = "TXT"
  ttl      = local.dns_ttl
}

resource "cloudflare_record" "txt-mx-splat" {
  depends_on = [
    cloudflare_record.root,
    cloudflare_record.splat ]
  zone_id  = var.cloudflare_functionalidiot_zoneid
  name     = "*"
  value    = "v=spf1 include:spf.messagingengine.com ?all"
  type     = "TXT"
  ttl      = local.dns_ttl
}

resource "cloudflare_record" "functionalidiot_com_ns1" {
  zone_id    = var.cloudflare_functionalidiot_zoneid
  name       = "@"
  value      = "mitch.ns.cloudflare.com"
  type       = "NS"
}

resource "cloudflare_record" "functionalidiot_com_ns2" {
  zone_id    = var.cloudflare_functionalidiot_zoneid
  name       = "@"
  value      = "tegan.ns.cloudflare.com"
  type       = "NS"
}

resource "null_resource" "functionalidiot_com_setup_new_gitea" {
  depends_on = [ null_resource.gitea_install ]
  count      = fileexists("${path.module}/attic/gitea.txz") ? 0 : 1
  connection {
    host        = linode_instance.prod.ip_address
    user        = "root"
    private_key = file("~/.ssh/id_rsa")
  }
  provisioner "file" {
    source      = "setup_gitea.sh"
    destination = "/tmp/setup_gitea.sh"
  }
  provisioner "remote-exec" {
    inline = [<<FIN
install -m755 /tmp/setup_gitea.sh /usr/local/bin/setup_gitea

rm -f /tmp/setup_gitea.sh

rc-update add gitea default

skey=$(su - gitea -c "gitea generate secret SECRET_KEY")
itoken=$(su - gitea -c "gitea generate secret INTERNAL_TOKEN")

SECRET_KEY=$skey INTERNAL_TOKEN=$itoken  /usr/local/bin/setup_gitea

rc-service gitea restart

sleep 3

chown gitea:www-data /var/lib/gitea/db/gitea.db

su - gitea -c "gitea migrate --config /etc/gitea/app.ini"

su - gitea -c "gitea admin create-user --username mitchty --password ${var.gitea_db_passwd} --email git@functionalidiot.com --admin --config /etc/gitea/app.ini"
FIN
    ]
  }
}

resource "null_resource" "functionalidiot_com_setup_saved_gitea" {
  depends_on = [ null_resource.gitea_install ]
  count      = fileexists("${path.module}/attic/gitea.txz") ? 1 : 0
  connection {
    host        = linode_instance.prod.ip_address
    user        = "root"
    private_key = file("~/.ssh/id_rsa")
  }
  provisioner "file" {
    source      = "${path.module}/attic/gitea.txz"
    destination = "/tmp/gitea.txz"
  }
  # TODO: Finish post untar setup
  provisioner "remote-exec" {
    inline = [<<FIN
cd /
tar xvJf /tmp/gitea.txz
rc-update add gitea default
rc-service gitea restart
FIN
    ]
  }
}

resource "null_resource" "functionalidiot_com_setup_saved_uacme" {
  depends_on = [ null_resource.uacme_install ]
  count      = fileexists("${path.module}/attic/uacme.txz") ? 1 : 0
  connection {
    host        = linode_instance.prod.ip_address
    user        = "root"
    private_key = file("~/.ssh/id_rsa")
  }
  provisioner "file" {
    source      = "${path.module}/attic/uacme.txz"
    destination = "/tmp/uacme.txz"
  }
  # TODO: Finish post untar setup
  provisioner "remote-exec" {
    inline = [<<FIN
cd /
tar xvJf /tmp/uacme.txz
FIN
    ]
  }
}

# FIXME: This nginx setup isn't idempotent if its a new setup vs saved
# uacme ssl setup.
#
# Maybe use the dns uacme crap instead of this stupid http bs?
#
# https://www.terraform.io/docs/providers/acme/r/certificate.html
# https://www.terraform.io/docs/providers/acme/dns_providers/cloudflare.html
resource "null_resource" "functionalidiot_com_setup_new_nginx" {
  depends_on = [
    null_resource.nginx_install,
    null_resource.functionalidiot_com_setup_new_gitea,
    null_resource.functionalidiot_com_setup_saved_gitea,
    null_resource.functionalidiot_com_setup_saved_uacme,
    null_resource.functionalidiot_com_setup_saved_uacme
  ]
  connection {
    host        = linode_instance.prod.ip_address
    user        = "root"
    private_key = file("~/.ssh/id_rsa")
  }
  provisioner "file" {
    source      = "http-default.conf"
    destination = "/tmp/http-default.conf"
  }
  provisioner "file" {
    source      = "https-functionalidiot.com.conf"
    destination = "/tmp/https-functionalidiot.com.conf"
  }
  provisioner "remote-exec" {
    inline = [<<FIN
[ -e /etc/nginx/conf.d/default.conf ] && mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf.disable
install -m644 /tmp/http-default.conf /etc/nginx/conf.d/http-default.conf
install -m644 /tmp/https-functionalidiot.com.conf /etc/nginx/conf.d/https-functionalidiot.com.conf
rm -fr /tmp/*.conf

install -dm755 /var/www/default/htdocs /var/www/.well-known/acme-challenge
echo todo write more stuff > /var/www/default/htdocs/index.html

rc-service nginx restart
FIN
    ]
  }
}