Compare commits

...

14 Commits

11 changed files with 946 additions and 508 deletions

View File

@@ -19,6 +19,12 @@ TERRAFORM_ENV := production
config_dir := ./config/ config_dir := ./config/
apps_config := $(config_dir)apps.config apps_config := $(config_dir)apps.config
BUTANE := butane -d ${PWD}
ifeq ($(shell command -v docker >/dev/null 2>&1 && echo yes),yes)
BUTANE := docker run --rm --volume ${PWD}:/pwd --workdir /pwd -i quay.io/coreos/butane:latest -d /pwd
endif
IMAGE_DEPS := IMAGE_DEPS :=
COMPOSE_ENVS := $(shell if [ -d app/ ]; then find app/ -type f -name '.compose-env'; fi) COMPOSE_ENVS := $(shell if [ -d app/ ]; then find app/ -type f -name '.compose-env'; fi)
@@ -84,7 +90,7 @@ restic-scheduled-snapshot.sh \
app/.env \ app/.env \
$(config_dir)ssh-keys \ $(config_dir)ssh-keys \
app.tar.gz app.tar.gz
cat cl.yaml | docker run --rm --volume $(config_dir)/ssh-keys:/pwd/ssh-keys --volume ${PWD}:/pwd --workdir /pwd -i quay.io/coreos/butane:latest -d /pwd > ignition.json cat cl.yaml | $(BUTANE) > ignition.json
generated.tfvars: $(apps_config) make-generated.sh generated.tfvars: $(apps_config) make-generated.sh
./make-generated.sh $(apps_config) > generated.tfvars ./make-generated.sh $(apps_config) > generated.tfvars

View File

@@ -24,6 +24,8 @@ app/nassella/lldap_postgres_password \
app/nassella/authelia_postgres_db \ app/nassella/authelia_postgres_db \
app/nassella/authelia_postgres_user \ app/nassella/authelia_postgres_user \
app/nassella/authelia_postgres_password \ app/nassella/authelia_postgres_password \
app/nassella/lldap_admin_password \
app/nassella/stripe_api_key \
app/nassella/nassella.env \ app/nassella/nassella.env \
app/nassella/authelia-config/configuration.yml \ app/nassella/authelia-config/configuration.yml \
app/nassella/lldap-config/lldap_config.toml app/nassella/lldap-config/lldap_config.toml

View File

@@ -20,7 +20,7 @@ passwd:
users: users:
- name: core - name: core
ssh_authorized_keys_local: ssh_authorized_keys_local:
- /ssh-keys - config/ssh-keys
- name: nextcloud - name: nextcloud
uid: 1001 uid: 1001
systemd: systemd:

View File

@@ -33,7 +33,7 @@ if [ $? -ne 0 ]; then
if [ $status -eq 10 ]; then if [ $status -eq 10 ]; then
# restic repo is not initialized so initialize it # restic repo is not initialized so initialize it
AWS_ACCESS_KEY_ID="$BACKBLAZE_KEY_ID" -e AWS_SECRET_ACCESS_KEY="$BACKBLAZE_APPLICATION_KEY" restic init --repo s3:$BACKBLAZE_BUCKET_URL --password-file restic-password AWS_ACCESS_KEY_ID="$BACKBLAZE_KEY_ID" AWS_SECRET_ACCESS_KEY="$BACKBLAZE_APPLICATION_KEY" restic init --repo s3:$BACKBLAZE_BUCKET_URL --password-file restic-password
init_status=$? init_status=$?
elif [ $status -ne 0 ]; then elif [ $status -ne 0 ]; then
# something unexpected happened, exit # something unexpected happened, exit

View File

@@ -31,8 +31,8 @@ set -e
. $1 # source the apps.config file with then env vars . $1 # source the apps.config file with then env vars
host_admin_password_encoded=`echo "$HOST_ADMIN_PASSWORD" | docker run --rm -i caddy:2 caddy hash-password` # host_admin_password_encoded=`echo "$HOST_ADMIN_PASSWORD" | docker run --rm -i caddy:2 caddy hash-password`
host_admin_password_encoded="password" # unused
read -r -a APP_CONFIGS <<< "$APP_CONFIGS" read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
APP_CONFIGS+=('lb,root') APP_CONFIGS+=('lb,root')

View File

@@ -30,7 +30,7 @@ RUN chicken-install srfi-1 srfi-13 srfi-18 srfi-19 srfi-158 srfi-194 \
sxml-transforms schematra \ sxml-transforms schematra \
uri-common http-client medea intarweb \ uri-common http-client medea intarweb \
sql-null openssl postgresql crypto-tools \ sql-null openssl postgresql crypto-tools \
hmac sha2 string-utils hmac sha2 string-utils base64
WORKDIR /var WORKDIR /var
RUN mkdir nassella RUN mkdir nassella
@@ -43,10 +43,17 @@ COPY run.scm run.scm
RUN csc -O3 -o nassella-run run.scm RUN csc -O3 -o nassella-run run.scm
RUN chmod +x nassella-run RUN chmod +x nassella-run
FROM quay.io/coreos/butane:release AS butane
FROM hashicorp/terraform:1.15 AS terraform
FROM debian:trixie-slim FROM debian:trixie-slim
RUN apt-get update && apt-get -y --no-install-recommends install \ RUN apt-get update && apt-get -y --no-install-recommends install \
libpq-dev ca-certificates gettext-base openssh-client restic \ libpq-dev ca-certificates gettext-base openssh-client restic make \
&& rm -rf /var/lib/apt/lists/* && rm -rf /var/lib/apt/lists/*
COPY --from=butane /usr/local/bin/butane /usr/local/bin/butane
COPY --from=terraform /bin/terraform /usr/local/bin/terraform
COPY --from=buildeggs /usr/local/ /usr/local/ COPY --from=buildeggs /usr/local/ /usr/local/
WORKDIR /var WORKDIR /var

View File

@@ -45,7 +45,9 @@ create table user_service_configs(
digitalocean_volume_size integer, digitalocean_volume_size integer,
backblaze_application_key_enc varchar(255), backblaze_application_key_enc varchar(255),
backblaze_key_id_enc varchar(255), backblaze_key_id_enc varchar(255),
backblaze_bucket_url_enc varchar(255) backblaze_bucket_url_enc varchar(255), -- deprecated 072526, replaced by bucket_name and bucket_id
backblaze_bucket_name_enc varchar(255),
backblaze_bucket_id_enc varchar(255)
); );
create unique index user_service_configs_user_id_instance_id_idx on user_service_configs (user_id, instance_id); create unique index user_service_configs_user_id_instance_id_idx on user_service_configs (user_id, instance_id);
@@ -62,6 +64,8 @@ insert into apps(app_name) values ('log-viewer');
insert into apps(app_name) values ('ghost'); insert into apps(app_name) values ('ghost');
insert into apps(app_name) values ('instance-control'); insert into apps(app_name) values ('instance-control');
insert into apps(app_name) values ('wordpress'); insert into apps(app_name) values ('wordpress');
insert into apps(app_name) values ('lldap');
insert into apps(app_name) values ('authelia');
create table user_selected_apps( create table user_selected_apps(
id bigserial primary key, id bigserial primary key,
@@ -89,7 +93,7 @@ create table user_app_configs(
create unique index user_app_configs_user_id_instance_id_idx on user_app_configs (user_id, instance_id); create unique index user_app_configs_user_id_instance_id_idx on user_app_configs (user_id, instance_id);
create type deployment_status as enum ('queued', 'in-progress', 'complete', 'failed'); create type deployment_status as enum ('ignored', 'queued', 'in-progress', 'complete', 'failed');
create table deployments( create table deployments(
id bigserial primary key, id bigserial primary key,

View File

@@ -197,7 +197,6 @@ returning users.user_id;"
(user-encrypt-for-db ssh-key-pub user-key user-iv user-id) (user-encrypt-for-db ssh-key-pub user-key user-iv user-id)
(user-encrypt-for-db restic-password user-key user-iv user-id))))) (user-encrypt-for-db restic-password user-key user-iv user-id)))))
(query conn "insert into user_service_configs(user_id, instance_id) values ($1, $2);" user-id instance-id) (query conn "insert into user_service_configs(user_id, instance_id) values ($1, $2);" user-id instance-id)
(query conn "insert into user_selected_apps(user_id, instance_id) values ($1, $2);" user-id instance-id)
(query conn "insert into user_app_configs(user_id, instance_id) values ($1, $2);" user-id instance-id) (query conn "insert into user_app_configs(user_id, instance_id) values ($1, $2);" user-id instance-id)
(query conn "insert into user_terraform_state(user_id, instance_id) values ($1, $2);" user-id instance-id) (query conn "insert into user_terraform_state(user_id, instance_id) values ($1, $2);" user-id instance-id)
instance-id))) instance-id)))
@@ -249,7 +248,9 @@ returning users.user_id;"
(digitalocean-volume-size . ("digitalocean_volume_size" #f)) (digitalocean-volume-size . ("digitalocean_volume_size" #f))
(backblaze-application-key . ("backblaze_application_key_enc" #t)) (backblaze-application-key . ("backblaze_application_key_enc" #t))
(backblaze-key-id . ("backblaze_key_id_enc" #t)) (backblaze-key-id . ("backblaze_key_id_enc" #t))
(backblaze-bucket-url . ("backblaze_bucket_url_enc" #t)))) (backblaze-bucket-url . ("backblaze_bucket_url_enc" #t))
(backblaze-bucket-name . ("backblaze_bucket_name_enc" #t))
(backblaze-bucket-id . ("backblaze_bucket_id_enc" #t))))
(define *user-service-configs-reverse-column-map* (define *user-service-configs-reverse-column-map*
(map (lambda (config) (map (lambda (config)
@@ -377,7 +378,8 @@ where usa.user_id=$1 and usa.instance_id=$2;"
'((queued . "queued") '((queued . "queued")
(in-progress . "in-progress") (in-progress . "in-progress")
(complete . "complete") (complete . "complete")
(failed . "failed"))) (failed . "failed")
(ignored . "ignored")))
(define (create-deployment conn user-id instance-id) (define (create-deployment conn user-id instance-id)
(value-at (value-at
(query conn (query conn
@@ -516,37 +518,51 @@ where usa.user_id=$1 and usa.instance_id=$2;"
"select apps.app_name, usa.installed_version, usa.instance_id from user_selected_apps usa "select apps.app_name, usa.installed_version, usa.instance_id from user_selected_apps usa
join apps on apps.id=usa.app_id join apps on apps.id=usa.app_id
where user_id=$1;" where user_id=$1;"
user-id)))) user-id)))
(map (undeployed-res
(lambda (instance) (query conn
(cons `(apps . ,(alist-ref (alist-ref 'instance-id instance) instance-apps)) (string-append
instance)) "select i.instance_id from instances as i "
"left join deployments d on d.instance_id = i.instance_id "
"where i.user_id=$1 and d.status is null "
"group by d.id, i.instance_id;")
user-id)))
(append
(map (map
(lambda (row-num) (lambda (instance)
(map (lambda (item) (cons `(apps . ,(alist-ref (alist-ref 'instance-id instance) instance-apps))
(let* ((key (car item)) instance))
(value (cdr item)) (map
(config (alist-ref key `((root_domain . root-domain) (lambda (row-num)
(config_enc . config) (cons '(deployed . #t)
(instance_id . instance-id) (map (lambda (item)
;; (wg_easy_version . wg-easy) (let* ((key (car item))
;; (nextcloud_version . nextcloud) (value (cdr item))
;; (ghost_version . ghost) (config (alist-ref key `((root_domain . root-domain)
;; (nassella_version . nassella) (config_enc . config)
;; (log_viewer_version . log-viewer) (instance_id . instance-id)
;; (instance_control_version . instance-control) ;; (wg_easy_version . wg-easy)
,@*deployments-reverse-column-map*)))) ;; (nextcloud_version . nextcloud)
`(,config . ,(if (sql-null? value) ;; (ghost_version . ghost)
#f ;; (nassella_version . nassella)
(if (and (string? value) (member config *deployments-column-map*)) ;; (log_viewer_version . log-viewer)
(string->symbol value) ;; (instance_control_version . instance-control)
(if (eq? key 'config_enc) ,@*deployments-reverse-column-map*))))
(with-input-from-string `(,config . ,(if (sql-null? value)
(user-decrypt-from-db value user-key user-iv user-id) #f
read) (if (and (string? value) (member config *deployments-column-map*))
value)))))) (string->symbol value)
(row-alist res row-num))) (if (eq? key 'config_enc)
(iota (row-count res))))))) (with-input-from-string
(user-decrypt-from-db value user-key user-iv user-id)
read)
value))))))
(row-alist res row-num))))
(iota (row-count res))))
(map (lambda (id) `((instance-id . ,id) (deployed . #f)))
(if (> (row-count undeployed-res) 0)
(row-values undeployed-res)
'()))))))
(define (update-user-terraform-state conn user-id instance-id state backup) (define (update-user-terraform-state conn user-id instance-id state backup)
(receive (user-key user-iv auth-user-id) (receive (user-key user-iv auth-user-id)
@@ -644,7 +660,9 @@ where user_id=$1;"
(4 . "fixing-app-normalization") (4 . "fixing-app-normalization")
(5 . "adding-wordpress-app") (5 . "adding-wordpress-app")
(6 . "adding-lldap-app") (6 . "adding-lldap-app")
(7 . "adding-authelia-app"))) (7 . "adding-authelia-app")
(8 . "adding-backblaze-bucket-name-and-id")
(9 . "extend-deployment-status-add-ignored")))
(define (run-pending-migrations conn) (define (run-pending-migrations conn)
(let* ((migration-ids (sort (map car *migrations*) <)) (let* ((migration-ids (sort (map car *migrations*) <))

View File

@@ -0,0 +1,2 @@
alter table user_service_configs add backblaze_bucket_name_enc varchar(255);
alter table user_service_configs add backblaze_bucket_id_enc varchar(255);

View File

@@ -0,0 +1 @@
alter type deployment_status add value 'ignored';

File diff suppressed because it is too large Load Diff