luke-else/server
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

feat: Swapped tofu init scripting for ansible scripting

Browse Source
This commit is contained in:
luke-else
2026-07-13 21:23:31 +01:00
parent cf5504281c
commit c12a507fc1
34 changed files with 471 additions and 501 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infra/modules/prod/main.tf
+4 -84
View File
@@ -83,30 +83,12 @@ resource "hcloud_server" "this" {
location = var.location
ssh_keys = var.ssh_key_ids
firewall_ids = [hcloud_firewall.this.id]
labels = { role = "prod" } # picked up by ansible/inventory/hcloud.yml
network {
network_id = var.network_id
ip = var.private_ip
}
connection {
type = "ssh"
host = self.ipv4_address
user = "root"
private_key = file(var.ssh_private_key_path)
}
provisioner "file" {
content = var.bootstrap_script
destination = "/root/bootstrap.sh"
}
provisioner "remote-exec" {
inline = [
"chmod +x /root/bootstrap.sh",
"/root/bootstrap.sh",
]
}
}
resource "hcloud_volume" "storage" {
@@ -125,70 +107,8 @@ locals {
# Hetzner's automount convention (hc-utils' 99-hc-volume-automount.rules) is
# always /mnt/HC_Volume_<id> - deterministic once the volume exists, since the
# id is stable for the volume's lifetime regardless of which server it's
# attached to.
# attached to. Kept here only as a human-readable output (see outputs.tf) -
# ansible/roles/deploy looks this up itself from the Hetzner API, it doesn't
# read this value.
data_dir = "/mnt/HC_Volume_${hcloud_volume.storage.id}"
}
# DATA_DIR is picked up automatically by `docker compose` (which auto-loads
# .env from its working directory) for every prod/*-docker-compose.yml bind
# mount - see services/prod/*.yml. Not committed (see .gitignore): it's tied to
# the live volume's ID, so it's regenerated by tofu apply, not handed off via git.
resource "local_file" "env" {
filename = "${path.root}/../services/prod/.env"
content = "DATA_DIR=${local.data_dir}\n"
file_permission = "0644"
}
locals {
# Everything under services/prod except .env: that's tracked via its own
# resource content (reading it back with fileset()/filesha1() before it
# exists would fail during `tofu plan`).
prod_static_files = sort([
for f in fileset("${path.root}/../services/prod", "**") : f if f != ".env"
])
prod_static_files_hash = sha1(join("", [
for f in local.prod_static_files : filesha1("${path.root}/../services/prod/${f}")
]))
}
# Copies services/prod to the server on every apply that changes it (a
# hand-edited compose file, ...) or recreates the server - not just once at
# first creation. Split from hcloud_server.this because it must run after
# local_file.env, which in turn depends on the volume, which depends on the
# server - so it can't be a provisioner on the server resource itself.
resource "null_resource" "deploy_services" {
triggers = {
server_id = hcloud_server.this.id
static_files = local.prod_static_files_hash
env = local_file.env.content
}
connection {
type = "ssh"
host = hcloud_server.this.ipv4_address
user = "root"
private_key = file(var.ssh_private_key_path)
}
provisioner "remote-exec" {
inline = ["mkdir -p /home/${var.deploy_user}/services"]
}
provisioner "file" {
source = "${path.root}/../services/prod"
destination = "/home/${var.deploy_user}/services"
}
provisioner "remote-exec" {
inline = [
"chown -R ${var.deploy_user}:${var.deploy_user} /home/${var.deploy_user}/services",
"chmod +x /home/${var.deploy_user}/services/prod/*.sh",
]
}
depends_on = [
hcloud_server.this,
local_file.env,
]
}