Improving Caddyfile build process.

.gitignore

@@ -11,4 +11,10 @@ ignition.json
 production.tfvars
 
 terraform.tfstate
-terraform.tfstate.backup
+terraform.tfstate.backup
+
+app
+
+apps.config
+
+all-apps/lb/Caddyfile

Makefile

@@ -1,11 +1,29 @@
-ignition:
-	$(MAKE) -C flatcar ignition
+TERRAFORM_ENV=production
 
-plan:
-	terraform plan -var-file production.tfvars
+# .dirstamp plus && $@ is like make magic to get this rule
+# to only run if the contents of all-apps changes
+app/.dirstamp: all-apps/app.service all-apps/docker-compose.yaml $(wildcard all-apps/lb/*) $(wildcard all-apps/Nextcloud/*) $(wildcard all-apps/wg-easy/*)
+	rm -Rf app/
+	cp -a all-apps app && touch $@
 
-apply:
-	terraform apply -var-file production.tfvars
+all-apps/lb/Caddyfile: apps.config make-caddyfile.sh
+	./make-caddyfile.sh > all-apps/lb/Caddyfile
 
+ignition.json: cl.yaml app/.dirstamp all-apps/lb/Caddyfile
+	cat cl.yaml | sudo docker run --rm --volume /home/tjhintz/.ssh/id_rsa.pub:/pwd/ssh-keys --volume ${PWD}:/pwd --workdir /pwd -i quay.io/coreos/butane:latest -d /pwd > ignition.json
+
+plan: ignition.json
+	terraform plan -var-file $(TERRAFORM_ENV).tfvars
+
+apply: ignition.json
+	terraform apply -var-file $(TERRAFORM_ENV).tfvars
+
+## to help me remember the command to run to test the config locally
 testlocalhost:
 	curl -k --resolve localhost:443:146.190.12.129 https://localhost
+
+flatcarbuild: ignition.json
+	cp --reflink=auto flatcar/flatcar_production_qemu_image.img.fresh flatcar/flatcar_production_qemu_image.img
+
+flatcarrun:
+	./flatcar/flatcar_production_qemu.sh -i ignition.json

all-apps/Makefile

@@ -0,0 +1,2 @@
+run:
+	sudo docker-compose -f docker-compose.yaml $(find . -mindepth 2 -maxdepth 2 -type f -name docker-compose.yaml -exec echo -f {} \;) up

all-apps/app.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=Main App
+After=docker.service
+Requires=docker.service
+[Service]
+TimeoutStartSec=0
+ExecStart=/bin/bash -c '/usr/bin/docker compose -f /app/docker-compose.yaml $(find /app -mindepth 2 -maxdepth 2 -type f -name docker-compose.yaml -exec echo -f {} \;) up'
+ExecStop=/bin/bash -c '/usr/bin/docker compose -f /app/docker-compose.yaml $(find /app -mindepth 2 -maxdepth 2 -type f -name docker-compose.yaml -exec echo -f {} \;) stop'
+
+Restart=always
+RestartSec=5s
+[Install]
+WantedBy=multi-user.target

all-apps/docker-compose.yaml

@@ -0,0 +1,25 @@
+version: '3'
+services:
+  lb:
+    image: docker.io/caddy:2
+    volumes:
+#      - /app/lb:/etc/caddy
+      - ./lb/:/etc/caddy
+      - config:/config
+      - data:/data
+    networks:
+      - lb
+    restart: unless-stopped
+    ports:
+      - "443:443"
+      - "80:80"
+  nginx:
+    image: nginx
+    restart: unless-stopped
+    networks:
+      - lb
+networks:
+  lb:
+volumes:
+  config:
+  data:

all-apps/nextcloud/docker-compose.yaml

@@ -0,0 +1,50 @@
+version: '3'
+
+services:
+  db:
+    image: postgres
+    shm_size: 128mb
+    restart: always
+    volumes:
+      - db:/var/lib/postgresql/data
+    environment:
+      - POSTGRES_DB=nextcloud
+      - POSTGRES_USER=nextcloud
+      - POSTGRES_PASSWORD=password
+    networks:
+      - internal
+  redis:
+    image: redis:alpine
+    restart: always
+    networks:
+      - internal
+  nextcloud:
+    image: nextcloud
+    environment:
+      - POSTGRES_HOST=db
+      - POSTGRES_DB=nextcloud
+      - POSTGRES_USER=nextcloud
+      - POSTGRES_PASSWORD=password
+      - NEXTCLOUD_ADMIN_PASSWORD=password
+      - NEXTCLOUD_ADMIN_USER=admin
+      - REDIS_HOST=redis
+      - NEXTCLOUD_TRUSTED_DOMAINS=nextcloud1.nassella.cc
+    ports:
+      - "8080:80"
+    depends_on:
+      - redis
+      - db
+    networks:
+      - lb
+      - internal
+    volumes:
+      - nextcloud:/var/www
+    restart: unless-stopped
+networks:
+  lb:
+  internal:
+    driver: bridge
+    internal: true
+volumes:
+  db:
+  nextcloud:

all-apps/wg-easy/docker-compose.yaml

@@ -0,0 +1,37 @@
+version: '3'
+services:
+  wg-easy:
+    image: ghcr.io/wg-easy/wg-easy:15
+    environment:
+      - PORT=80
+    ports:
+      - "51820:51820/udp"
+    networks:
+      lb:
+      wg:
+        ipv4_address: 10.42.42.42
+#        ipv6_address: fdcc:ad94:bacf:61a3::2a
+    volumes:
+      - etc_wireguard:/etc/wireguard
+      - /lib/modules:/lib/modules:ro
+    restart: unless-stopped
+    cap_add:
+      - NET_ADMIN
+      - SYS_MODULE
+    sysctls:
+      - net.ipv4.ip_forward=1
+      - net.ipv4.conf.all.src_valid_mark=1
+      - net.ipv6.conf.all.disable_ipv6=0
+      - net.ipv6.conf.all.forwarding=1
+      - net.ipv6.conf.default.forwarding=1
+networks:
+  lb:
+  wg:
+    driver: bridge
+    ipam:
+      driver: default
+      config:
+        - subnet: 10.42.42.0/24
+        - subnet: fdcc:ad94:bacf:61a3::/64
+volumes:
+  etc_wireguard:

apps.config.tmpl

@@ -0,0 +1,2 @@
+ROOT_DOMAIN=example.com
+APP_CONFIGS="nextcloud,nextcloud wg-easy,wg-easy"

flatcar/Makefile

@@ -1,12 +0,0 @@
-# get the directory of this makefile
-ROOT_DIR:=$(shell dirname "$(realpath $(firstword $(MAKEFILE_LIST)))")
-
-ignition:
-	cat cl.yaml | sudo docker run --rm --volume /home/tjhintz/.ssh/id_rsa.pub:/pwd/ssh-keys --volume ${ROOT_DIR}:/pwd --workdir /pwd -i quay.io/coreos/butane:latest -d /pwd > ignition.json
-
-build:
-	cp --reflink=auto flatcar_production_qemu_image.img.fresh flatcar_production_qemu_image.img
-	make ignition
-
-run:
-	./flatcar_production_qemu.sh -i ignition.json

main.tf

@@ -136,7 +136,7 @@ resource "digitalocean_droplet" "machine" {
   region    = var.datacenter
   size      = var.server_type
   ssh_keys  = [digitalocean_ssh_key.first.fingerprint]
-  user_data = file("flatcar/ignition.json")
+  user_data = file("ignition.json")
   lifecycle {
     create_before_destroy = true
   }

make-caddyfile.sh

@@ -0,0 +1,42 @@
+#!/bin/bash
+
+# this script generates the load-balancer
+# config for the Caddy server.
+
+# it depends on apps.config which should define:
+# ROOT_DOMAIN - the root domain for all apps
+# APP_CONFIGS - app-subdomain pairs, configured via a comma, like:
+#   app1,subdomain1 app2,subdomain2 app3,subdomain3
+# full example:
+#   ROOT_DOMAIN=nassella.cc
+#   APP_CONFIGS="app1,subdomain1 app2,subdomain2 app3,subdomain3"
+
+set -e
+
+. apps.config
+
+read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
+APP_CONFIGS+=('lb,root')
+
+
+declare -A bodys
+bodys["nextcloud"]="  reverse_proxy http://nextcloud:80"
+bodys["wg-easy"]="  reverse_proxy http://wg-easy:80"
+bodys["lb"]="  reverse_proxy http://nginx:80"
+
+for config_string in ${APP_CONFIGS[@]}; do
+    IFS=','
+    read -r -a config <<< "$config_string"
+
+    app=${config[0]}
+    subdomain=${config[1]}
+    body=${bodys[$app]}
+    fulldomain="$subdomain.$ROOT_DOMAIN"
+
+    echo "$fulldomain {"
+    echo $body
+    echo "}"
+done
+
+
+