From b492ff208f1c989448bc89cfa1a13cd21dfad0f7 Mon Sep 17 00:00:00 2001 From: Thomas Hintz Date: Wed, 15 Jul 2026 15:18:34 -0700 Subject: [PATCH] Fixing nassella-in-production bugs. --- Makefile | 8 +++++++- cl.yaml | 2 +- init-restic.sh | 2 +- make-caddyfile-env.sh | 4 ++-- src/Dockerfile | 9 ++++++++- src/nassella.scm | 7 +++++-- 6 files changed, 24 insertions(+), 8 deletions(-) diff --git a/Makefile b/Makefile index 9e8acc0..bffea5b 100644 --- a/Makefile +++ b/Makefile @@ -19,6 +19,12 @@ TERRAFORM_ENV := production config_dir := ./config/ apps_config := $(config_dir)apps.config +BUTANE := butane -d ${PWD} + +ifeq ($(shell command -v docker >/dev/null 2>&1 && echo yes),yes) + BUTANE := docker run --rm --volume ${PWD}:/pwd --workdir /pwd -i quay.io/coreos/butane:latest -d /pwd +endif + IMAGE_DEPS := COMPOSE_ENVS := $(shell if [ -d app/ ]; then find app/ -type f -name '.compose-env'; fi) @@ -84,7 +90,7 @@ restic-scheduled-snapshot.sh \ app/.env \ $(config_dir)ssh-keys \ app.tar.gz - cat cl.yaml | docker run --rm --volume $(config_dir)/ssh-keys:/pwd/ssh-keys --volume ${PWD}:/pwd --workdir /pwd -i quay.io/coreos/butane:latest -d /pwd > ignition.json + cat cl.yaml | $(BUTANE) > ignition.json generated.tfvars: $(apps_config) make-generated.sh ./make-generated.sh $(apps_config) > generated.tfvars diff --git a/cl.yaml b/cl.yaml index 8535e2d..2b994c5 100644 --- a/cl.yaml +++ b/cl.yaml @@ -20,7 +20,7 @@ passwd: users: - name: core ssh_authorized_keys_local: - - /ssh-keys + - config/ssh-keys - name: nextcloud uid: 1001 systemd: diff --git a/init-restic.sh b/init-restic.sh index 371d1ca..5a2c406 100755 --- a/init-restic.sh +++ b/init-restic.sh @@ -33,7 +33,7 @@ if [ $? -ne 0 ]; then if [ $status -eq 10 ]; then # restic repo is not initialized so initialize it - AWS_ACCESS_KEY_ID="$BACKBLAZE_KEY_ID" -e AWS_SECRET_ACCESS_KEY="$BACKBLAZE_APPLICATION_KEY" restic init --repo s3:$BACKBLAZE_BUCKET_URL --password-file restic-password + AWS_ACCESS_KEY_ID="$BACKBLAZE_KEY_ID" AWS_SECRET_ACCESS_KEY="$BACKBLAZE_APPLICATION_KEY" restic init --repo s3:$BACKBLAZE_BUCKET_URL --password-file restic-password init_status=$? elif [ $status -ne 0 ]; then # something unexpected happened, exit diff --git a/make-caddyfile-env.sh b/make-caddyfile-env.sh index e9ad0f9..718ca30 100755 --- a/make-caddyfile-env.sh +++ b/make-caddyfile-env.sh @@ -31,8 +31,8 @@ set -e . $1 # source the apps.config file with then env vars -host_admin_password_encoded=`echo "$HOST_ADMIN_PASSWORD" | docker run --rm -i caddy:2 caddy hash-password` - +# host_admin_password_encoded=`echo "$HOST_ADMIN_PASSWORD" | docker run --rm -i caddy:2 caddy hash-password` +host_admin_password_encoded="password" # unused read -r -a APP_CONFIGS <<< "$APP_CONFIGS" APP_CONFIGS+=('lb,root') diff --git a/src/Dockerfile b/src/Dockerfile index 7e24fc7..d511b7d 100644 --- a/src/Dockerfile +++ b/src/Dockerfile @@ -43,10 +43,17 @@ COPY run.scm run.scm RUN csc -O3 -o nassella-run run.scm RUN chmod +x nassella-run +FROM quay.io/coreos/butane:release AS butane +FROM hashicorp/terraform:1.15 AS terraform + FROM debian:trixie-slim RUN apt-get update && apt-get -y --no-install-recommends install \ - libpq-dev ca-certificates gettext-base openssh-client restic \ + libpq-dev ca-certificates gettext-base openssh-client restic make \ && rm -rf /var/lib/apt/lists/* + +COPY --from=butane /usr/local/bin/butane /usr/local/bin/butane +COPY --from=terraform /bin/terraform /usr/local/bin/terraform + COPY --from=buildeggs /usr/local/ /usr/local/ WORKDIR /var diff --git a/src/nassella.scm b/src/nassella.scm index dde6238..2b1cd73 100644 --- a/src/nassella.scm +++ b/src/nassella.scm @@ -793,7 +793,9 @@ h1, h2, h3, h4, h5, h6 { (dev ;; in dev copy personal ssh key (copy-file "../config/ssh-keys" (string-append dir "/config/ssh-keys"))) - (else '())) + (else + ;; in prod, no ssh-keys, but we need the file to exist for Make + (with-output-to-file (string-append dir "/config/ssh-keys") (lambda () (display ""))))) (with-output-to-file (string-append dir "/terraform.tfstate") (lambda () (write-string state))) (with-output-to-file (string-append dir "/terraform.tfstate.backup") (lambda () (write-string state-backup)))) @@ -1577,6 +1579,7 @@ chmod -R 777 /opt/keys"))) (restic-password (alist-ref 'restic-password results)) (dir (deployment-directory (session-user-id) instance-id))) (setup-deploy-files dir (alist-ref 'state terraform-state) (alist-ref 'backup terraform-state)) + (log-to (debug-log) "writing configs") (with-output-to-file (string-append dir "/config/apps.config") (lambda () (map (lambda (e) @@ -1653,7 +1656,7 @@ chmod -R 777 /opt/keys"))) ("cloudflare_api_token" . ,(alist-ref 'cloudflare-api-token service-config)) ("cloudflare_zone_id" . ,(alist-ref 'cloudflare-zone-id service-config)) ("cloudflare_account_id" . ,(alist-ref 'cloudflare-account-id service-config)) - ("cluster_name" . "nassella") + ("cluster_name" . ,(string-append "nassella" (string-delete #\. root-domain))) ;; TODO update to: (import srfi-14) (string-filter char-set:letter+digit root-domain) ("datacenter" . ,(alist-ref 'digitalocean-region service-config)) ;; (source <(curl -sSfL https://stable.release.flatcar-linux.net/amd64-usr/current/version.txt); echo "${FLATCAR_VERSION_ID}") ("flatcar_stable_version" . "4593.2.4")))