Refactor build process to clean it up.

.gitignore

@@ -12,3 +12,5 @@ production.tfvars
 
 terraform.tfstate
 terraform.tfstate.backup
+
+app

Makefile

@@ -1,11 +1,26 @@
-ignition:
+TERRAFORM_ENV=production
-	$(MAKE) -C flatcar ignition
 
-plan:
+# .dirstamp plus && $@ is like make magic to get this rule
-	terraform plan -var-file production.tfvars
+# to only run if the contents of all-apps changes
+app/.dirstamp: all-apps/app.service all-apps/docker-compose.yaml $(wildcard all-apps/lb/*) $(wildcard all-apps/Nextcloud/*) $(wildcard all-apps/wg-easy/*)
+	rm -Rf app/
+	cp -a all-apps app && touch $@
 
-apply:
+ignition.json: cl.yaml app/.dirstamp
-	terraform apply -var-file production.tfvars
+	cat cl.yaml | sudo docker run --rm --volume /home/tjhintz/.ssh/id_rsa.pub:/pwd/ssh-keys --volume ${PWD}:/pwd --workdir /pwd -i quay.io/coreos/butane:latest -d /pwd > ignition.json
 
+plan: ignition.json
+	terraform plan -var-file $(TERRAFORM_ENV).tfvars
+
+apply: ignition.json
+	terraform apply -var-file $(TERRAFORM_ENV).tfvars
+
+## to help me remember the command to run to test the config locally
 testlocalhost:
 	curl -k --resolve localhost:443:146.190.12.129 https://localhost
+
+flatcarbuild: ignition.json
+	cp --reflink=auto flatcar/flatcar_production_qemu_image.img.fresh flatcar/flatcar_production_qemu_image.img
+
+flatcarrun:
+	./flatcar/flatcar_production_qemu.sh -i ignition.json

all-apps/Makefile

@@ -0,0 +1,2 @@
+run:
+	sudo docker-compose -f docker-compose.yaml $(find . -mindepth 2 -maxdepth 2 -type f -name docker-compose.yaml -exec echo -f {} \;) up

all-apps/app.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=Main App
+After=docker.service
+Requires=docker.service
+[Service]
+TimeoutStartSec=0
+ExecStart=/bin/bash -c '/usr/bin/docker compose -f /app/docker-compose.yaml $(find /app -mindepth 2 -maxdepth 2 -type f -name docker-compose.yaml -exec echo -f {} \;) up'
+ExecStop=/bin/bash -c '/usr/bin/docker compose -f /app/docker-compose.yaml $(find /app -mindepth 2 -maxdepth 2 -type f -name docker-compose.yaml -exec echo -f {} \;) stop'
+
+Restart=always
+RestartSec=5s
+[Install]
+WantedBy=multi-user.target

all-apps/docker-compose.yaml

@@ -0,0 +1,25 @@
+version: '3'
+services:
+  lb:
+    image: docker.io/caddy:2
+    volumes:
+#      - /app/lb:/etc/caddy
+      - ./lb/:/etc/caddy
+      - config:/config
+      - data:/data
+    networks:
+      - lb
+    restart: unless-stopped
+    ports:
+      - "443:443"
+      - "80:80"
+  nginx:
+    image: nginx
+    restart: unless-stopped
+    networks:
+      - lb
+networks:
+  lb:
+volumes:
+  config:
+  data:

all-apps/lb/Caddyfile

@@ -0,0 +1,17 @@
+wg-easy1.nassella.cc {
+  reverse_proxy http://wg-easy:80
+
+  # tls internal
+  # x
+  # log
+}
+
+nextcloud1.nassella.cc {
+  reverse_proxy http://nextcloud:80
+  # tls internal
+}
+
+root.nassella.cc {
+  reverse_proxy http://nginx:80
+  # tls internal
+}

all-apps/nextcloud/docker-compose.yaml

@@ -0,0 +1,50 @@
+version: '3'
+
+services:
+  db:
+    image: postgres
+    shm_size: 128mb
+    restart: always
+    volumes:
+      - db:/var/lib/postgresql/data
+    environment:
+      - POSTGRES_DB=nextcloud
+      - POSTGRES_USER=nextcloud
+      - POSTGRES_PASSWORD=password
+    networks:
+      - internal
+  redis:
+    image: redis:alpine
+    restart: always
+    networks:
+      - internal
+  nextcloud:
+    image: nextcloud
+    environment:
+      - POSTGRES_HOST=db
+      - POSTGRES_DB=nextcloud
+      - POSTGRES_USER=nextcloud
+      - POSTGRES_PASSWORD=password
+      - NEXTCLOUD_ADMIN_PASSWORD=password
+      - NEXTCLOUD_ADMIN_USER=admin
+      - REDIS_HOST=redis
+      - NEXTCLOUD_TRUSTED_DOMAINS=nextcloud1.nassella.cc
+    ports:
+      - "8080:80"
+    depends_on:
+      - redis
+      - db
+    networks:
+      - lb
+      - internal
+    volumes:
+      - nextcloud:/var/www
+    restart: unless-stopped
+networks:
+  lb:
+  internal:
+    driver: bridge
+    internal: true
+volumes:
+  db:
+  nextcloud:

all-apps/wg-easy/docker-compose.yaml

@@ -0,0 +1,37 @@
+version: '3'
+services:
+  wg-easy:
+    image: ghcr.io/wg-easy/wg-easy:15
+    environment:
+      - PORT=80
+    ports:
+      - "51820:51820/udp"
+    networks:
+      lb:
+      wg:
+        ipv4_address: 10.42.42.42
+#        ipv6_address: fdcc:ad94:bacf:61a3::2a
+    volumes:
+      - etc_wireguard:/etc/wireguard
+      - /lib/modules:/lib/modules:ro
+    restart: unless-stopped
+    cap_add:
+      - NET_ADMIN
+      - SYS_MODULE
+    sysctls:
+      - net.ipv4.ip_forward=1
+      - net.ipv4.conf.all.src_valid_mark=1
+      - net.ipv6.conf.all.disable_ipv6=0
+      - net.ipv6.conf.all.forwarding=1
+      - net.ipv6.conf.default.forwarding=1
+networks:
+  lb:
+  wg:
+    driver: bridge
+    ipam:
+      driver: default
+      config:
+        - subnet: 10.42.42.0/24
+        - subnet: fdcc:ad94:bacf:61a3::/64
+volumes:
+  etc_wireguard:

flatcar/Makefile

@@ -1,12 +0,0 @@
-# get the directory of this makefile
-ROOT_DIR:=$(shell dirname "$(realpath $(firstword $(MAKEFILE_LIST)))")
-
-ignition:
-	cat cl.yaml | sudo docker run --rm --volume /home/tjhintz/.ssh/id_rsa.pub:/pwd/ssh-keys --volume ${ROOT_DIR}:/pwd --workdir /pwd -i quay.io/coreos/butane:latest -d /pwd > ignition.json
-
-build:
-	cp --reflink=auto flatcar_production_qemu_image.img.fresh flatcar_production_qemu_image.img
-	make ignition
-
-run:
-	./flatcar_production_qemu.sh -i ignition.json

main.tf

@@ -136,7 +136,7 @@ resource "digitalocean_droplet" "machine" {
   region    = var.datacenter
   size      = var.server_type
   ssh_keys  = [digitalocean_ssh_key.first.fingerprint]
-  user_data = file("flatcar/ignition.json")
+  user_data = file("ignition.json")
   lifecycle {
     create_before_destroy = true
   }