Initial Commit

2026-03-06 19:17:15 +01:00
commit 3bf5960302
36 changed files with 5859 additions and 0 deletions
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -0,0 +1,208 @@
+name: Deploy / Update Apps
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "apps/**.tfvars"
+
+env:
+  TOFU_VERSION: "1.9.0"
+
+jobs:
+  detect-changes:
+    name: Detect changed tfvars files
+    runs-on: ubuntu-latest
+    outputs:
+      added_modified: ${{ steps.diff.outputs.added_modified }}
+      deleted: ${{ steps.diff.outputs.deleted }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+
+      - name: Compute diff
+        id: diff
+        run: |
+          ADDED_MODIFIED=$(git diff --name-only --diff-filter=ACM HEAD~1 HEAD -- 'apps/*.tfvars' | jq -R -s -c 'split("\n") | map(select(length > 0))')
+          DELETED=$(git diff --name-only --diff-filter=D HEAD~1 HEAD -- 'apps/*.tfvars' | jq -R -s -c 'split("\n") | map(select(length > 0))')
+          echo "added_modified=$ADDED_MODIFIED" >> "$GITHUB_OUTPUT"
+          echo "deleted=$DELETED"               >> "$GITHUB_OUTPUT"
+
+  # ─── Deploy / Update ──────────────────────────────────────────────────────
+  deploy:
+    name: Deploy ${{ matrix.tfvars }}
+    needs: detect-changes
+    if: ${{ needs.detect-changes.outputs.added_modified != '[]' }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        tfvars: ${{ fromJson(needs.detect-changes.outputs.added_modified) }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install OpenTofu
+        run: |
+          curl -fsSL https://get.opentofu.org/install-opentofu.sh | sh -s -- --install-method=standalone --opentofu-version=${{ env.TOFU_VERSION }}
+
+      - name: Install gopass
+        run: |
+          curl -fsSL https://github.com/gopasspw/gopass/releases/latest/download/gopass-linux-amd64.tar.gz | tar xz
+          sudo mv gopass /usr/local/bin/
+
+      - name: Configure gopass
+        env:
+          GOPASS_GPG_KEY: ${{ secrets.GOPASS_GPG_KEY }}
+          GOPASS_STORE_REPO: ${{ secrets.GOPASS_STORE_REPO }}
+        run: |
+          echo "$GOPASS_GPG_KEY" | gpg --batch --import
+          gopass clone "$GOPASS_STORE_REPO"
+
+      - name: Resolve app name from tfvars filename
+        id: app
+        run: |
+          TFVARS="${{ matrix.tfvars }}"
+          APP=$(basename "$TFVARS" .tfvars)
+          echo "name=$APP" >> "$GITHUB_OUTPUT"
+
+      - name: Fetch SSH key from gopass
+        run: |
+          # Adjust the gopass path to match your store layout
+          gopass show -o "infra/ssh-keys/${{ steps.app.outputs.name }}" > /tmp/deploy_key
+          chmod 600 /tmp/deploy_key
+
+      - name: Fetch secrets from gopass
+        id: secrets
+        run: |
+          DB_PASSWORD=$(gopass show -o "apps/${{ steps.app.outputs.name }}/db_password")
+          GIT_TOKEN=$(gopass show -o "apps/${{ steps.app.outputs.name }}/git_token" 2>/dev/null || echo "")
+          echo "::add-mask::$DB_PASSWORD"
+          echo "::add-mask::$GIT_TOKEN"
+          echo "db_password=$DB_PASSWORD" >> "$GITHUB_OUTPUT"
+          echo "git_token=$GIT_TOKEN"     >> "$GITHUB_OUTPUT"
+
+      - name: tofu init
+        env:
+          # SeaweedFS S3 credentials (set in Gitea repo secrets)
+          AWS_ACCESS_KEY_ID:     ${{ secrets.SEAWEED_ACCESS_KEY }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.SEAWEED_SECRET_KEY }}
+        run: |
+          tofu init \
+            -backend-config="bucket=tofu-state" \
+            -backend-config="key=apps/${{ steps.app.outputs.name }}.tfstate" \
+            -backend-config="endpoint=${{ secrets.SEAWEED_S3_ENDPOINT }}" \
+            -backend-config="region=us-east-1" \
+            -backend-config="force_path_style=true"
+
+      - name: Select or create workspace
+        run: |
+          tofu workspace select "${{ steps.app.outputs.name }}" \
+            || tofu workspace new "${{ steps.app.outputs.name }}"
+
+      - name: tofu apply
+        env:
+          AWS_ACCESS_KEY_ID:     ${{ secrets.SEAWEED_ACCESS_KEY }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.SEAWEED_SECRET_KEY }}
+        run: |
+          tofu apply -auto-approve \
+            -var-file="${{ matrix.tfvars }}" \
+            -var="ssh_key_path=/tmp/deploy_key" \
+            -var="db_password=${{ steps.secrets.outputs.db_password }}" \
+            -var="openresty_git_token=${{ steps.secrets.outputs.git_token }}"
+
+      - name: Cleanup SSH key
+        if: always()
+        run: rm -f /tmp/deploy_key
+
+  # ─── Destroy (tfvars file deleted) ────────────────────────────────────────
+  destroy:
+    name: Destroy ${{ matrix.tfvars }}
+    needs: detect-changes
+    if: ${{ needs.detect-changes.outputs.deleted != '[]' }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        tfvars: ${{ fromJson(needs.detect-changes.outputs.deleted) }}
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Checkout the previous commit so we still have the tfvars file
+          ref: ${{ github.event.before }}
+
+      - name: Install OpenTofu
+        run: |
+          curl -fsSL https://get.opentofu.org/install-opentofu.sh | sh -s -- --install-method=standalone --opentofu-version=${{ env.TOFU_VERSION }}
+
+      - name: Install gopass
+        run: |
+          curl -fsSL https://github.com/gopasspw/gopass/releases/latest/download/gopass-linux-amd64.tar.gz | tar xz
+          sudo mv gopass /usr/local/bin/
+
+      - name: Configure gopass
+        env:
+          GOPASS_GPG_KEY: ${{ secrets.GOPASS_GPG_KEY }}
+          GOPASS_STORE_REPO: ${{ secrets.GOPASS_STORE_REPO }}
+        run: |
+          echo "$GOPASS_GPG_KEY" | gpg --batch --import
+          gopass clone "$GOPASS_STORE_REPO"
+
+      - name: Resolve app name
+        id: app
+        run: |
+          APP=$(basename "${{ matrix.tfvars }}" .tfvars)
+          echo "name=$APP" >> "$GITHUB_OUTPUT"
+
+      - name: Fetch SSH key from gopass
+        run: |
+          gopass show -o "infra/ssh-keys/${{ steps.app.outputs.name }}" > /tmp/deploy_key
+          chmod 600 /tmp/deploy_key
+
+      - name: Fetch secrets from gopass
+        id: secrets
+        run: |
+          DB_PASSWORD=$(gopass show -o "apps/${{ steps.app.outputs.name }}/db_password")
+          GIT_TOKEN=$(gopass show -o "apps/${{ steps.app.outputs.name }}/git_token" 2>/dev/null || echo "")
+          echo "::add-mask::$DB_PASSWORD"
+          echo "::add-mask::$GIT_TOKEN"
+          echo "db_password=$DB_PASSWORD" >> "$GITHUB_OUTPUT"
+          echo "git_token=$GIT_TOKEN"     >> "$GITHUB_OUTPUT"
+
+      - name: tofu init
+        env:
+          AWS_ACCESS_KEY_ID:     ${{ secrets.SEAWEED_ACCESS_KEY }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.SEAWEED_SECRET_KEY }}
+        run: |
+          tofu init \
+            -backend-config="bucket=tofu-state" \
+            -backend-config="key=apps/${{ steps.app.outputs.name }}.tfstate" \
+            -backend-config="endpoint=${{ secrets.SEAWEED_S3_ENDPOINT }}" \
+            -backend-config="region=us-east-1" \
+            -backend-config="force_path_style=true"
+
+      - name: Select workspace
+        run: tofu workspace select "${{ steps.app.outputs.name }}"
+
+      - name: tofu destroy
+        env:
+          AWS_ACCESS_KEY_ID:     ${{ secrets.SEAWEED_ACCESS_KEY }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.SEAWEED_SECRET_KEY }}
+        run: |
+          tofu destroy -auto-approve \
+            -var-file="${{ matrix.tfvars }}" \
+            -var="ssh_key_path=/tmp/deploy_key" \
+            -var="db_password=${{ steps.secrets.outputs.db_password }}" \
+            -var="openresty_git_token=${{ steps.secrets.outputs.git_token }}"
+
+      - name: Delete workspace
+        run: |
+          tofu workspace select default
+          tofu workspace delete "${{ steps.app.outputs.name }}"
+
+      - name: Cleanup SSH key
+        if: always()
+        run: rm -f /tmp/deploy_key