chore: refined control script
This commit is contained in:
+127
-19
@@ -7,11 +7,19 @@
|
||||
# ever runs `tofu`/`ansible-playbook` for you - it's a menu wrapper, nothing
|
||||
# more, so anything it does you can also do by hand from infra/ or ansible/.
|
||||
|
||||
# Re-exec under bash if invoked as `sh control.sh` (or another POSIX shell) -
|
||||
# this script relies on bash-only features (indirect expansion, arrays, [[ ]])
|
||||
# that fail with cryptic errors like "bad substitution" under dash/sh.
|
||||
if [ -z "${BASH_VERSION:-}" ]; then
|
||||
exec bash "$0" "$@"
|
||||
fi
|
||||
|
||||
set -uo pipefail
|
||||
|
||||
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
INFRA_DIR="$REPO_ROOT/infra"
|
||||
ANSIBLE_DIR="$REPO_ROOT/ansible"
|
||||
CONTROL_ENV="$REPO_ROOT/.control.env"
|
||||
|
||||
# --- pretty output --------------------------------------------------------
|
||||
if [ -t 1 ]; then
|
||||
@@ -35,6 +43,32 @@ detect_tofu() {
|
||||
}
|
||||
detect_tofu
|
||||
|
||||
# --- variable persistence --------------------------------------------------
|
||||
# Variables set via the "Set variables" menu (HCLOUD_TOKEN, BACKUP_S3_*,
|
||||
# DEPLOY_USER, ANSIBLE_SSH_PRIVATE_KEY_FILE) live in .control.env, gitignored,
|
||||
# so they survive between runs of this script. They are NOT exported into your
|
||||
# normal shell - only into control.sh's own process and whatever it runs.
|
||||
load_control_env() {
|
||||
if [ -f "$CONTROL_ENV" ]; then
|
||||
set -a
|
||||
# shellcheck disable=SC1090
|
||||
source "$CONTROL_ENV"
|
||||
set +a
|
||||
fi
|
||||
}
|
||||
load_control_env
|
||||
|
||||
# Upsert KEY=VALUE into .control.env and export it into this process.
|
||||
save_var() {
|
||||
local key="$1" val="$2"
|
||||
touch "$CONTROL_ENV"; chmod 600 "$CONTROL_ENV"
|
||||
local tmp; tmp="$(mktemp)"
|
||||
grep -v "^${key}=" "$CONTROL_ENV" > "$tmp" 2>/dev/null || true
|
||||
mv "$tmp" "$CONTROL_ENV"
|
||||
printf '%s=%q\n' "$key" "$val" >> "$CONTROL_ENV"
|
||||
export "${key?}=${val}"
|
||||
}
|
||||
|
||||
# Run a command inside a directory, echoing it first. Returns the command's exit code.
|
||||
run_in() {
|
||||
local dir="$1"; shift
|
||||
@@ -64,19 +98,78 @@ check_prereqs() {
|
||||
[ -n "${BACKUP_S3_ACCESS_KEY_ID:-}" ] && ok "BACKUP_S3_ACCESS_KEY_ID set" || warn "BACKUP_S3_ACCESS_KEY_ID not set"
|
||||
[ -n "${BACKUP_S3_SECRET_ACCESS_KEY:-}" ] && ok "BACKUP_S3_SECRET_ACCESS_KEY set" || warn "BACKUP_S3_SECRET_ACCESS_KEY not set"
|
||||
[ -n "${BACKUP_S3_ENDPOINT:-}" ] && ok "BACKUP_S3_ENDPOINT set" || warn "BACKUP_S3_ENDPOINT not set (omit only for real AWS S3)"
|
||||
ok "DEPLOY_USER: ${DEPLOY_USER:-deploy} (default 'deploy' if unset)"
|
||||
|
||||
local key="${ANSIBLE_SSH_PRIVATE_KEY_FILE:-$HOME/.ssh/id_ed25519}"
|
||||
[ -f "${key/#\~/$HOME}" ] && ok "SSH key present ($key)" || warn "SSH key not found at $key (set ANSIBLE_SSH_PRIVATE_KEY_FILE)"
|
||||
|
||||
[ -f "$CONTROL_ENV" ] && ok ".control.env present (loaded above)" || warn "No .control.env yet - use Configuration > Set variables to persist the above across runs"
|
||||
|
||||
title "Files"
|
||||
[ -f "$INFRA_DIR/terraform.tfvars" ] && ok "infra/terraform.tfvars exists" \
|
||||
|| bad "infra/terraform.tfvars missing (copy terraform.tfvars.example and fill in ssh_key_names)"
|
||||
|| bad "infra/terraform.tfvars missing (Configuration > Copy terraform.tfvars.example)"
|
||||
[ -d "$INFRA_DIR/.terraform" ] && ok "infra/.terraform exists (tofu init has run)" \
|
||||
|| warn "infra/.terraform missing - run OpenTofu > init"
|
||||
if ansible-galaxy collection list hetzner.hcloud >/dev/null 2>&1; then ok "hetzner.hcloud collection installed"
|
||||
else warn "hetzner.hcloud collection not installed - run Ansible > Install collections"; fi
|
||||
}
|
||||
|
||||
# --- configuration actions -------------------------------------------------
|
||||
# Prompts for one variable, keeping the current value if the user hits Enter.
|
||||
# $3 = true masks input and the shown current value, for tokens/secrets.
|
||||
prompt_var() {
|
||||
local key="$1" desc="$2" secret="${3:-false}" current input shown
|
||||
current="${!key:-}"
|
||||
shown="$current"
|
||||
[ "$secret" = "true" ] && [ -n "$current" ] && shown="(set, hidden)"
|
||||
if [ "$secret" = "true" ]; then read -rsp "$desc [$shown]: " input; echo
|
||||
else read -rp "$desc [$shown]: " input; fi
|
||||
[ -n "$input" ] && save_var "$key" "$input"
|
||||
}
|
||||
|
||||
set_variables() {
|
||||
title "Set variables"
|
||||
echo "Leave a prompt blank to keep its current value. Saved to .control.env" \
|
||||
"(gitignored) and reloaded automatically next time you run control.sh -" \
|
||||
"not exported to your normal shell outside of it."
|
||||
echo
|
||||
prompt_var HCLOUD_TOKEN "Hetzner Cloud API token" true
|
||||
prompt_var DEPLOY_USER "Non-root deploy user Ansible creates (default: deploy)" false
|
||||
prompt_var ANSIBLE_SSH_PRIVATE_KEY_FILE "SSH private key path (default: ~/.ssh/id_ed25519)" false
|
||||
prompt_var BACKUP_S3_BUCKET "S3 backup bucket name" false
|
||||
prompt_var BACKUP_S3_ACCESS_KEY_ID "S3 backup access key ID" true
|
||||
prompt_var BACKUP_S3_SECRET_ACCESS_KEY "S3 backup secret access key" true
|
||||
prompt_var BACKUP_S3_ENDPOINT "S3 backup endpoint (blank for real AWS S3)" false
|
||||
ok "Variables saved."
|
||||
}
|
||||
|
||||
copy_tfvars() {
|
||||
local example="$INFRA_DIR/terraform.tfvars.example"
|
||||
local target="$INFRA_DIR/terraform.tfvars"
|
||||
if [ -f "$target" ]; then
|
||||
warn "infra/terraform.tfvars already exists."
|
||||
confirm "Overwrite it with a fresh copy of the example?" || return 0
|
||||
fi
|
||||
cp "$example" "$target"
|
||||
ok "Copied terraform.tfvars.example -> terraform.tfvars"
|
||||
|
||||
local keys quoted k
|
||||
read -rp "SSH key name(s) from Hetzner Console > Security > SSH Keys, comma-separated (blank = edit manually later): " keys
|
||||
if [ -n "$keys" ]; then
|
||||
quoted=""
|
||||
IFS=',' read -ra _key_arr <<< "$keys"
|
||||
for k in "${_key_arr[@]}"; do
|
||||
k="$(echo "$k" | xargs)"
|
||||
quoted+="\"$k\", "
|
||||
done
|
||||
quoted="${quoted%, }"
|
||||
sed -i "s|^ssh_key_names = .*|ssh_key_names = [${quoted}]|" "$target"
|
||||
ok "Set ssh_key_names = [${quoted}]"
|
||||
else
|
||||
warn "ssh_key_names still has the example's placeholder values - edit infra/terraform.tfvars before running tofu."
|
||||
fi
|
||||
}
|
||||
|
||||
# --- OpenTofu actions -----------------------------------------------------
|
||||
require_tofu() {
|
||||
if [ -z "$TOFU" ]; then bad "No tofu/terraform binary found."; return 1; fi
|
||||
@@ -120,6 +213,7 @@ accept SSH from the vpn server's public IP, so vpn must exist and you must be
|
||||
connected to it (OpenVPN) before dev/prod are reachable.
|
||||
|
||||
Steps, in order:
|
||||
0. Configuration: variables + terraform.tfvars (skip if already done)
|
||||
1. OpenTofu: init -> plan -> apply (creates servers, network, firewalls, DNS)
|
||||
2. Ansible: bootstrap + deploy + spinup for role_vpn
|
||||
3. YOU: connect to the VPN with an OpenVPN client
|
||||
@@ -127,6 +221,14 @@ Steps, in order:
|
||||
EOF
|
||||
confirm "Start the guided walkthrough?" || return 0
|
||||
|
||||
echo; title "0/4 Configuration"
|
||||
if confirm "Set/update variables now (HCLOUD_TOKEN, DEPLOY_USER, BACKUP_S3_*, SSH key path)?"; then
|
||||
set_variables
|
||||
fi
|
||||
if [ ! -f "$INFRA_DIR/terraform.tfvars" ] && confirm "infra/terraform.tfvars is missing - create it from the example now?"; then
|
||||
copy_tfvars
|
||||
fi
|
||||
|
||||
echo; title "1/4 OpenTofu"
|
||||
if confirm "Run $TOFU init/plan/apply now?"; then
|
||||
tofu_init && tofu_plan && tofu_apply || { bad "OpenTofu step failed - stopping."; return 1; }
|
||||
@@ -158,15 +260,19 @@ menu() {
|
||||
echo " 1) Check prerequisites"
|
||||
echo " 2) Guided full setup (vpn -> connect -> dev/prod)"
|
||||
|
||||
title "Configuration"
|
||||
echo " 3) Set variables (HCLOUD_TOKEN, DEPLOY_USER, BACKUP_S3_*, SSH key path)"
|
||||
echo " 4) Copy terraform.tfvars.example -> terraform.tfvars"
|
||||
|
||||
title "OpenTofu (infra/)"
|
||||
echo " 3) init 4) plan 5) apply"
|
||||
echo " 6) output 7) destroy"
|
||||
echo " 5) init 6) plan 7) apply"
|
||||
echo " 8) output 9) destroy"
|
||||
|
||||
title "Ansible (ansible/)"
|
||||
echo " 8) Install collections 9) Show inventory"
|
||||
echo " 10) Bootstrap vpn 11) Deploy + spinup vpn"
|
||||
echo " 12) Bootstrap dev+prod 13) Deploy + spinup dev+prod"
|
||||
echo " 14) Spindown (choose target)"
|
||||
echo " 10) Install collections 11) Show inventory"
|
||||
echo " 12) Bootstrap vpn 13) Deploy + spinup vpn"
|
||||
echo " 14) Bootstrap dev+prod 15) Deploy + spinup dev+prod"
|
||||
echo " 16) Spindown (choose target)"
|
||||
|
||||
echo
|
||||
echo " 0) Quit"
|
||||
@@ -179,18 +285,20 @@ while true; do
|
||||
case "$choice" in
|
||||
1) check_prereqs; pause ;;
|
||||
2) guided; pause ;;
|
||||
3) tofu_init; pause ;;
|
||||
4) tofu_plan; pause ;;
|
||||
5) tofu_apply; pause ;;
|
||||
6) tofu_output; pause ;;
|
||||
7) tofu_destroy; pause ;;
|
||||
8) ansible_collections; pause ;;
|
||||
9) ansible_inventory; pause ;;
|
||||
10) ansible_bootstrap_vpn; pause ;;
|
||||
11) ansible_deploy_vpn; pause ;;
|
||||
12) ansible_bootstrap_dp; pause ;;
|
||||
13) ansible_deploy_dp; pause ;;
|
||||
14) ansible_spindown; pause ;;
|
||||
3) set_variables; pause ;;
|
||||
4) copy_tfvars; pause ;;
|
||||
5) tofu_init; pause ;;
|
||||
6) tofu_plan; pause ;;
|
||||
7) tofu_apply; pause ;;
|
||||
8) tofu_output; pause ;;
|
||||
9) tofu_destroy; pause ;;
|
||||
10) ansible_collections; pause ;;
|
||||
11) ansible_inventory; pause ;;
|
||||
12) ansible_bootstrap_vpn; pause ;;
|
||||
13) ansible_deploy_vpn; pause ;;
|
||||
14) ansible_bootstrap_dp; pause ;;
|
||||
15) ansible_deploy_dp; pause ;;
|
||||
16) ansible_spindown; pause ;;
|
||||
0) echo "Bye."; exit 0 ;;
|
||||
"") ;;
|
||||
*) warn "Unknown option: $choice"; pause ;;
|
||||
|
||||
Reference in New Issue
Block a user