Fixing nassella-in-production bugs.

Makefile

@@ -19,6 +19,12 @@ TERRAFORM_ENV := production
 config_dir := ./config/
 apps_config := $(config_dir)apps.config
 
+BUTANE := butane -d ${PWD}
+
+ifeq ($(shell command -v docker >/dev/null 2>&1 && echo yes),yes)
+	BUTANE := docker run --rm --volume ${PWD}:/pwd --workdir /pwd -i quay.io/coreos/butane:latest -d /pwd
+endif
+
 IMAGE_DEPS :=
 
 COMPOSE_ENVS := $(shell if [ -d app/ ]; then find app/ -type f -name '.compose-env'; fi)
@@ -84,7 +90,7 @@ restic-scheduled-snapshot.sh \
 app/.env \
 $(config_dir)ssh-keys \
 app.tar.gz
-	cat cl.yaml | docker run --rm --volume $(config_dir)/ssh-keys:/pwd/ssh-keys --volume ${PWD}:/pwd --workdir /pwd -i quay.io/coreos/butane:latest -d /pwd > ignition.json
+	cat cl.yaml | $(BUTANE) > ignition.json
 
 generated.tfvars: $(apps_config) make-generated.sh
 	./make-generated.sh $(apps_config) > generated.tfvars

cl.yaml

@@ -20,7 +20,7 @@ passwd:
   users:
     - name: core
       ssh_authorized_keys_local:
-        - /ssh-keys
+        - config/ssh-keys
     - name: nextcloud
       uid: 1001
 systemd:

init-restic.sh

@@ -33,7 +33,7 @@ if [ $? -ne 0 ]; then
 
     if [ $status -eq 10 ]; then
         # restic repo is not initialized so initialize it
-        AWS_ACCESS_KEY_ID="$BACKBLAZE_KEY_ID" -e AWS_SECRET_ACCESS_KEY="$BACKBLAZE_APPLICATION_KEY" restic init --repo s3:$BACKBLAZE_BUCKET_URL --password-file restic-password
+        AWS_ACCESS_KEY_ID="$BACKBLAZE_KEY_ID" AWS_SECRET_ACCESS_KEY="$BACKBLAZE_APPLICATION_KEY" restic init --repo s3:$BACKBLAZE_BUCKET_URL --password-file restic-password
         init_status=$?
     elif [ $status -ne 0  ]; then
         # something unexpected happened, exit

make-caddyfile-env.sh

@@ -31,8 +31,8 @@ set -e
 
 . $1 # source the apps.config file with then env vars
 
-host_admin_password_encoded=`echo "$HOST_ADMIN_PASSWORD" | docker run --rm -i caddy:2 caddy hash-password`
-
+# host_admin_password_encoded=`echo "$HOST_ADMIN_PASSWORD" | docker run --rm -i caddy:2 caddy hash-password`
+host_admin_password_encoded="password" # unused
 
 read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
 APP_CONFIGS+=('lb,root')

src/Dockerfile

@@ -43,10 +43,17 @@ COPY run.scm run.scm
 RUN csc -O3 -o nassella-run run.scm
 RUN chmod +x nassella-run
 
+FROM quay.io/coreos/butane:release AS butane
+FROM hashicorp/terraform:1.15 AS terraform
+
 FROM debian:trixie-slim
 RUN apt-get update && apt-get -y --no-install-recommends install \
- libpq-dev ca-certificates gettext-base openssh-client restic \
+ libpq-dev ca-certificates gettext-base openssh-client restic make \
  && rm -rf /var/lib/apt/lists/*
+
+COPY --from=butane /usr/local/bin/butane /usr/local/bin/butane
+COPY --from=terraform /bin/terraform /usr/local/bin/terraform
+
 COPY --from=buildeggs /usr/local/ /usr/local/
 
 WORKDIR /var

src/nassella.scm

@@ -793,7 +793,9 @@ h1, h2, h3, h4, h5, h6 {
     (dev
      ;; in dev copy personal ssh key
      (copy-file "../config/ssh-keys" (string-append dir "/config/ssh-keys")))
-    (else '()))
+    (else
+     ;; in prod, no ssh-keys, but we need the file to exist for Make
+     (with-output-to-file (string-append dir "/config/ssh-keys") (lambda () (display "")))))
   (with-output-to-file (string-append dir "/terraform.tfstate") (lambda () (write-string state)))
   (with-output-to-file (string-append dir "/terraform.tfstate.backup") (lambda () (write-string state-backup))))
 
@@ -1577,6 +1579,7 @@ chmod -R 777 /opt/keys")))
              (restic-password (alist-ref 'restic-password results))
              (dir (deployment-directory (session-user-id) instance-id)))
         (setup-deploy-files dir (alist-ref 'state terraform-state) (alist-ref 'backup terraform-state))
+        (log-to (debug-log) "writing configs")
         (with-output-to-file (string-append dir "/config/apps.config")
           (lambda ()
             (map (lambda (e)
@@ -1653,7 +1656,7 @@ chmod -R 777 /opt/keys")))
                    ("cloudflare_api_token" . ,(alist-ref 'cloudflare-api-token service-config))
                    ("cloudflare_zone_id" . ,(alist-ref 'cloudflare-zone-id service-config))
                    ("cloudflare_account_id" . ,(alist-ref 'cloudflare-account-id service-config))
-                   ("cluster_name" . "nassella")
+                   ("cluster_name" . ,(string-append "nassella" (string-delete #\. root-domain))) ;; TODO update to: (import srfi-14) (string-filter char-set:letter+digit root-domain)
                    ("datacenter" . ,(alist-ref 'digitalocean-region service-config))
                    ;; (source <(curl -sSfL https://stable.release.flatcar-linux.net/amd64-usr/current/version.txt); echo "${FLATCAR_VERSION_ID}")
                    ("flatcar_stable_version" . "4593.2.4")))