vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Turn a fresh machine into an instance on first boot

04e063ca5d73b8f57f45d7c8bb07b0fdaa91b5b8 · Keenan Nemetz · 3d ago · parent ea21f923

Turn a fresh machine into an instance on first boot

A new instance is one package, one configuration, one directory, and one
account. Assembling that by hand is where a first deployment goes wrong:
the capability the hardened unit needs for ports 80 and 443, the order that
makes the package's own init harmless, and the fact that the first instance
admin has to be granted on the host.

deploy/cloud-init/vole.yaml is that assembly. It stages two configurations,
one that lets Vole hold its own certificate and one that leaves TLS to a
proxy, then installs the package, writes the configuration, creates the
instance admin, and starts the service. Running it again changes nothing.

render.sh renders it for providers that take user data without Terraform,
using the placeholder list as the contract with the template.

The three Terraform configurations create the machine, its firewall, its
address, and optionally the DNS record, and hand it that same file. They are
root modules: init and apply, three variables, no other file to edit.

First boot is not configuration management. apply does not upgrade an
instance or touch its data, because users.db migrates in place and cannot be
rolled back.

deploy/terraform/digitalocean/variables.tf +102

@@ -0,0 +1,102 @@
	1	variable "name" {
	2	description = "Name for the droplet, firewall, and SSH key."
	3	type = string
	4	default = "vole"
	5	}
	6
	7	variable "domain" {
	8	description = "DNS name the instance answers on, as in forge.example.com. It becomes public_url, and passkeys are bound to it, so it cannot change later without re-enrolling everyone."
	9	type = string
	10
	11	validation {
	12	condition = !startswith(var.domain, "http://") && !startswith(var.domain, "https://")
	13	error_message = "domain is a bare host name: forge.example.com, not https://forge.example.com."
	14	}
	15	}
	16
	17	variable "admin_account" {
	18	description = "Name of the first account, made an instance admin. Account names are permanent."
	19	type = string
	20	default = "admin"
	21	}
	22
	23	variable "admin_ssh_public_key" {
	24	description = "Public key of the first account, as in file contents: ssh-ed25519 AAAAC3... you@host."
	25	type = string
	26	}
	27
	28	variable "admin_email" {
	29	description = "Contact address given to the certificate authority. Optional but recommended when ACME is on."
	30	type = string
	31	default = ""
	32	}
	33
	34	variable "instance_name" {
	35	description = "Name the landing page shows."
	36	type = string
	37	default = "Vole"
	38	}
	39
	40	variable "tls_mode" {
	41	description = "acme lets Vole obtain its own certificate on ports 80 and 443 and needs DNS pointing here. proxy leaves TLS to a proxy in front and serves plain HTTP on loopback."
	42	type = string
	43	default = "acme"
	44
	45	validation {
	46	condition = contains(["acme", "proxy"], var.tls_mode)
	47	error_message = "tls_mode must be acme or proxy."
	48	}
	49	}
	50
	51	variable "vole_package_url" {
	52	description = "URL of the .deb for this machine's architecture, from a Vole release page: https://.../r/vole/releases/v0.2.0/artifacts/vole_0.2.0-1_amd64.deb"
	53	type = string
	54	}
	55
	56	variable "region" {
	57	description = "DigitalOcean region, as in nyc3, sfo3, ams3, fra1, blr1, syd1."
	58	type = string
	59	default = "nyc3"
	60	}
	61
	62	variable "size" {
	63	description = "Droplet size slug. s-2vcpu-4gb is enough for a small team; s-4vcpu-8gb doubles the CPU, memory, and disk."
	64	type = string
	65	default = "s-2vcpu-4gb"
	66	}
	67
	68	variable "image" {
	69	description = "Ubuntu or Debian image slug. The cloud-init file runs on either."
	70	type = string
	71	default = "ubuntu-24-04-x64"
	72	}
	73
	74	variable "enable_backups" {
	75	description = "Weekly DigitalOcean backups. Costs about 20% of the droplet price, and is not a substitute for an off-site copy of the instance."
	76	type = bool
	77	default = true
	78	}
	79
	80	variable "create_dns" {
	81	description = "Create the A record in a DigitalOcean domain this account already owns. Leave false to point your own DNS at the address output instead."
	82	type = bool
	83	default = false
	84	}
	85
	86	variable "dns_zone" {
	87	description = "Zone for create_dns, as in example.com. The record is created for the domain variable."
	88	type = string
	89	default = ""
	90	}
	91
	92	variable "ssh_admin_cidrs" {
	93	description = "Addresses allowed to reach port 22 (server login) and port 2222 (Git over SSH). Restrict these to your team if you can."
	94	type = list(string)
	95	default = ["0.0.0.0/0", "::/0"]
	96	}
	97
	98	variable "cloud_init_file" {
	99	description = "Override the user data file. Empty uses deploy/cloud-init/vole.yaml from this repository."
	100	type = string
	101	default = ""
	102	}