vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Drop the Terraform configurations; cloud-init is the deployment path

51624dc663738e70cc37b8ac5e232841fd49aaf8 · Keenan Nemetz · 3d ago · parent e21f6c5e

Drop the Terraform configurations; cloud-init is the deployment path

A Vole instance is one package, one configuration file, and one directory.
The first-boot file that installs the package and writes the configuration
is that same work described once, and it needs no provider, no state file,
and no cloud token with write access to an account. What Terraform did
outside the machine — firewall, address, DNS record — is three fields in a
console the operator already has open.

So the three configurations go, and with them what existed only to check
them: the pinned Terraform download in the verify image, the `fmt -check`
step, the .terraform entries in the ignore file, and the directory skip in
the link checker. The deployment check now needs python3 and PyYAML and
nothing else — no network, no credentials.

deploy/README.md keeps the reasoning, so the next person tempted to add a
provider back sees what it would buy and what it would cost.

The templates' header comments no longer name a renderer that is gone:
render.sh fills them in, and check-deploy.py renders them the same way.

deploy/cloud-init/runner.yaml +4−5

@@ -6,11 +6,10 @@
	6	6	# repository code, and a runner can read every secret its jobs declare, so it
	7	7	# should not share a disk with the account database and the SSH host key.
	8	8	#
	9		# Each placeholder below is a value the caller supplies. Terraform renders this
	10		# file with templatefile(); deploy/cloud-init/render.sh renders it with
	11		# envsubst(). Both read a placeholder as a dollar sign followed by a name in
	12		# braces, so shell variables in the script at the bottom are written without
	13		# braces and are left alone.
		9	# Each placeholder below is a value the caller supplies, and render.sh fills them
		10	# in: a placeholder is a dollar sign followed by a name in braces, so shell
		11	# variables in the script at the bottom are written without braces and are left
		12	# alone. scripts/check-deploy.py renders this file the same way to check it.
	14	13
	15	14	hostname: ${runner_hostname}
	16	15	fqdn: ${runner_hostname}