vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Turn a fresh machine into an instance on first boot

04e063ca5d73b8f57f45d7c8bb07b0fdaa91b5b8 · Keenan Nemetz · 3d ago · parent ea21f923

Turn a fresh machine into an instance on first boot

A new instance is one package, one configuration, one directory, and one
account. Assembling that by hand is where a first deployment goes wrong:
the capability the hardened unit needs for ports 80 and 443, the order that
makes the package's own init harmless, and the fact that the first instance
admin has to be granted on the host.

deploy/cloud-init/vole.yaml is that assembly. It stages two configurations,
one that lets Vole hold its own certificate and one that leaves TLS to a
proxy, then installs the package, writes the configuration, creates the
instance admin, and starts the service. Running it again changes nothing.

render.sh renders it for providers that take user data without Terraform,
using the placeholder list as the contract with the template.

The three Terraform configurations create the machine, its firewall, its
address, and optionally the DNS record, and hand it that same file. They are
root modules: init and apply, three variables, no other file to edit.

First boot is not configuration management. apply does not upgrade an
instance or touch its data, because users.db migrates in place and cannot be
rolled back.

deploy/terraform/digitalocean/main.tf +140

@@ -0,0 +1,140 @@
	1	# A Vole instance on DigitalOcean, configured by cloud-init.
	2	#
	3	# Run it from a clone of the Vole repository, because the machine's user data is
	4	# deploy/cloud-init/vole.yaml and is read by its path:
	5	#
	6	# cd deploy/terraform/digitalocean
	7	# terraform init
	8	# terraform apply \
	9	# -var domain=forge.example.com \
	10	# -var "admin_ssh_public_key=$(cat ~/.ssh/id_ed25519.pub)" \
	11	# -var vole_package_url=https://example.com/r/vole/releases/v0.2.0/artifacts/vole_0.2.0-1_amd64.deb
	12	#
	13	# DIGITALOCEAN_TOKEN must be set. See docs/deploy/digitalocean.md.
	14
	15	terraform {
	16	required_version = ">= 1.9"
	17	required_providers {
	18	digitalocean = {
	19	source = "digitalocean/digitalocean"
	20	version = ">= 2.40"
	21	}
	22	}
	23	}
	24
	25	provider "digitalocean" {}
	26
	27	locals {
	28	labels = ["app:vole"]
	29
	30	user_data = templatefile(
	31	var.cloud_init_file != "" ? var.cloud_init_file : "${path.module}/../../cloud-init/vole.yaml",
	32	{
	33	hostname = var.domain
	34	admin_account = var.admin_account
	35	admin_ssh_key = trimspace(var.admin_ssh_public_key)
	36	admin_email = var.admin_email
	37	instance_name = var.instance_name
	38	tls_mode = var.tls_mode
	39	vole_package_url = var.vole_package_url
	40	}
	41	)
	42	}
	43
	44	resource "digitalocean_ssh_key" "admin" {
	45	name = "${var.name}-admin"
	46	public_key = trimspace(var.admin_ssh_public_key)
	47	}
	48
	49	resource "digitalocean_firewall" "vole" {
	50	name = var.name
	51	droplet_ids = [digitalocean_droplet.vole.id]
	52
	53	inbound_rule {
	54	protocol = "tcp"
	55	port_range = "22"
	56	source_addresses = var.ssh_admin_cidrs
	57	}
	58
	59	# Git over SSH. Restricting this to your team's addresses is the cheapest way
	60	# to take the write surface off the internet.
	61	inbound_rule {
	62	protocol = "tcp"
	63	port_range = "2222"
	64	source_addresses = var.ssh_admin_cidrs
	65	}
	66
	67	inbound_rule {
	68	protocol = "tcp"
	69	port_range = "80"
	70	source_addresses = ["0.0.0.0/0", "::/0"]
	71	}
	72
	73	inbound_rule {
	74	protocol = "tcp"
	75	port_range = "443"
	76	source_addresses = ["0.0.0.0/0", "::/0"]
	77	}
	78
	79	inbound_rule {
	80	protocol = "icmp"
	81	source_addresses = ["0.0.0.0/0", "::/0"]
	82	}
	83
	84	outbound_rule {
	85	protocol = "tcp"
	86	port_range = "1-65535"
	87	destination_addresses = ["0.0.0.0/0", "::/0"]
	88	}
	89
	90	outbound_rule {
	91	protocol = "udp"
	92	port_range = "1-65535"
	93	destination_addresses = ["0.0.0.0/0", "::/0"]
	94	}
	95
	96	outbound_rule {
	97	protocol = "icmp"
	98	destination_addresses = ["0.0.0.0/0", "::/0"]
	99	}
	100	}
	101
	102	resource "digitalocean_droplet" "vole" {
	103	name = var.name
	104	image = var.image
	105	size = var.size
	106	region = var.region
	107	ssh_keys = [digitalocean_ssh_key.admin.fingerprint]
	108	tags = local.labels
	109	ipv6 = true
	110
	111	user_data = local.user_data
	112
	113	# Free: the agent reports CPU and disk to DigitalOcean's graphs, which is the
	114	# quickest way to see that a build ate the disk.
	115	monitoring = true
	116
	117	# Weekly droplet backups. Not a substitute for a copy you keep elsewhere; see
	118	# docs/deploy/README.md.
	119	backups = var.enable_backups
	120
	121	lifecycle {
	122	ignore_changes = [user_data]
	123	}
	124	}
	125
	126	resource "digitalocean_domain" "this" {
	127	count = var.create_dns ? 1 : 0
	128
	129	name = var.dns_zone
	130	}
	131
	132	resource "digitalocean_record" "forge" {
	133	count = var.create_dns ? 1 : 0
	134
	135	domain = digitalocean_domain.this[0].name
	136	type = "A"
	137	name = "@"
	138	value = digitalocean_droplet.vole.ipv4_address
	139	ttl = 300
	140	}