Merge pull request #448 from dump-hr/add-archive

Add archive

.github/workflows/deploy.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - main
+      - '2024'
 
   workflow_dispatch:
 
@@ -49,6 +50,7 @@ jobs:
           file: ./apps/api/Dockerfile
           push: true
           tags: ghcr.io/${{ github.repository }}:${{ github.sha }},
+            ghcr.io/${{ github.repository }}:${{ github.ref_name }},
             ghcr.io/${{ github.repository }}:${{ github.ref_name == 'main' && 'latest' || 'unstable' }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -90,4 +92,4 @@ jobs:
       - name: Run Ansible playbook
         run: |
           eval $(ssh-agent)
-          ./infrastructure/scripts/ansible-playbook.sh production api
+          ./infrastructure/scripts/ansible-playbook.sh ${{ github.ref_name == 'main' && 'production' || github.ref_name }} api

.github/workflows/docker-image-build.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches-ignore:
       - main
+      - '2024'
 
   workflow_dispatch:
 
@@ -48,7 +49,6 @@ jobs:
           context: .
           file: ./apps/api/Dockerfile
           push: true
-          tags: ghcr.io/${{ github.repository }}:${{ github.sha }},
-            ghcr.io/${{ github.repository }}:${{ github.ref_name == 'main' && 'latest' || 'unstable' }}
+          tags: ghcr.io/${{ github.repository }}:${{ github.sha }}
           cache-from: type=gha
           cache-to: type=gha,mode=max

infrastructure/ansible/inventories/2024.aws_ec2.yml

@@ -0,0 +1,17 @@
+---
+plugin: aws_ec2
+profile: ddays-app
+
+regions:
+  - eu-central-1
+
+hostnames:
+  - ip-address
+
+filters:
+  tag:Project: ddays-app
+  tag:Environment: 2024
+
+keyed_groups:
+  - key: tags.Role
+leading_separator: false

infrastructure/ansible/playbooks/api/playbook.yml

@@ -25,6 +25,6 @@
     - role: traefik
     - role: api
       vars:
-        docker_image: ghcr.io/dump-hr/ddays-app:latest
-        env_file: production
-        api_domain: days.dump.hr
+        docker_image: '{{ docker_image }}'
+        env_file: '{{ env_file }}'
+        api_domain: '{{ api_domain }}'

infrastructure/ansible/playbooks/api/roles/api/files/2024.enc.env

@@ -0,0 +1,17 @@
+NODE_ENV=ENC[AES256_GCM,data:ZJTcH7KZxHPcnA==,iv:k8A1U8FzruYQJ9Mdkx85jswQMb9rbz+aCwRolz1OCRA=,tag:FBDllBWZzLGrTeOQP7+Qxg==,type:str]
+DATABASE_URL=ENC[AES256_GCM,data:fF2BH2N2f7tImPzEPsu/CCHSuwOb07UKIo2aO5VHHfLc1Bmt4Tj3vtOatyr1E6xpP0f51mBR8RANQWYNyqwYi0oP5UMyC5snvLwqljazVd0gOv1ejU0l2me9CRSsei83UCy7/Dk5oFkM+FeqW2dw+RKw+j13L5/sE9NCmVXTf2URUXAgMsorCzjFBUB6MnfJtDD5nuhZd40ZSH/1dQORWyabJuSWtZ98hcIkp7p9ZZ5KMmzc8Q9YyZWdM9o9CVgGn2haGKac2k1QSfQ=,iv:nwnjdHhr+3CdWk9oKznoIDu6OJIk5fduTr8gZqvxOJM=,tag:QAV6ucNMQ9+FTcTzUOtqeQ==,type:str]
+RUN_MIGRATIONS_ON_STARTUP=ENC[AES256_GCM,data:7hhEQw==,iv:DfpOwgJIXcJl+bhlYv3PsKZ3Oxv1OL/2Mlqq4Tnr1bQ=,tag:wvozpDOk0LQNZl6tPuJR3Q==,type:str]
+AAD_TENANT_ID=ENC[AES256_GCM,data:n4oRFx/MR7IW/ZoEzwY40GjeSHX3paeNXiqI1ANBy2x3CnM5,iv:HZSiF4kDTYoWn/RWKgvgC4h7e4/mNPLLY8nk/qpDQCE=,tag:98S8jg8CSZaEpH7+icSvzQ==,type:str]
+JWT_SECRET=ENC[AES256_GCM,data:m0BX04I+WQRcvOzIeaa0yVGH3nUlILFFIn5w5foLkbycJvLHnQGflA==,iv:IjRUj8s+Wzq3VNM6N4iXZISXetNfUo8IGNZF+0wRHok=,tag:DtD2O7wGOl7t/J7fN5uSIg==,type:str]
+AWS_ACCESS_KEY_ID=ENC[AES256_GCM,data:cDmJe4w4ulkfw22HjEdu0HWDs8w=,iv:7gSyyqkDVhyVKCFGFxe3YGm1pXdvik3J549V3ewcFWU=,tag:8vzDE1tCVD1ZLxaN6BGHPQ==,type:str]
+AWS_SECRET_ACCESS_KEY=ENC[AES256_GCM,data:Tmgsr/vTY9OpGAMhBub6eC1W3Hu3pLbfcVTPqQEBxe385RuUWS/yOA==,iv:+AQPGY+ozj9BDBEsHsQ8MUbGrcOQNi3Nmfpqd5hJHhU=,tag:o2vZhWza2qOvocFLRE1DlQ==,type:str]
+AWS_S3_BUCKET=ENC[AES256_GCM,data:uPsfT5hBLg8F/hPaUZnBrbk=,iv:ZaYgEjWsRwcS5Z4iWXVtvnv46MR7h3shTnkgRnM/nWk=,tag:Mht5oyMDt0xZceuB4Fm7iQ==,type:str]
+AWS_S3_URL=ENC[AES256_GCM,data:SFSMevdB5IdZ7qY1ueiDOQsKrhB5/Dk9rSJp6fyzv55c,iv:keUyKyNHIWQVSTtZNKMMyhczPI5r/4XGK/3CZyG9eLQ=,tag:5A8sZkxyx5f5uLB58tQwew==,type:str]
+sops_kms__list_0__map_arn=arn:aws:kms:us-east-1:763640948377:alias/ddays-app
+sops_kms__list_0__map_created_at=2024-01-17T23:19:29Z
+sops_kms__list_0__map_enc=AQICAHgdcjswtFLRk2r0EsHvbS93T1AaxRGQ/GRNaO0DtK3p7QH2x6u7Sn853Jp5ObqvnZUgAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMmdGLQYhSHC9fA7DRAgEQgDsEVeyn6ahs0a2ULlJ/lbb8AdPEPwL2FlwM/9534AGAAY2pCFm+ybhVatpAPlcst6uPQkcvtP+v0Itk6w==
+sops_lastmodified=2024-01-23T23:02:34Z
+sops_unencrypted_suffix=_unencrypted
+sops_version=3.7.3
+sops_mac=ENC[AES256_GCM,data:uNkDks/IYW4fahYqXvbnvpNm0WCDOlrGBlRuH42b+0eG+VTyw87jpBCp6VxxPCLZJekJcUtfgCLhjC+HhavYCdT77cVlJykSIfJpp0wLZpWzYExhwl7dRyTzLF8PflB1r8xOudBqLS2tRhYmQNnbcBbq9kyGWUkvsozUxZznZ4g=,iv:Nnfh78T2NU+6nQYzOyI/QG+MTdhRXxOx6jB4V6wsMvY=,tag:1z+HDLm1xRb/zUZQAl8SKQ==,type:str]
+sops_kms__list_0__map_aws_profile=ddays-app

infrastructure/ansible/vars/2024.yml

@@ -0,0 +1,4 @@
+---
+docker_image: ghcr.io/dump-hr/ddays-app:2024
+env_file: '2024'
+api_domain: 2024-days.dump.hr

infrastructure/ansible/vars/production.yml

@@ -0,0 +1,4 @@
+---
+docker_image: ghcr.io/dump-hr/ddays-app:main
+env_file: production
+api_domain: days.dump.hr

infrastructure/scripts/ansible-playbook.sh

@@ -26,7 +26,8 @@ fi
 cd ../ansible || exit 1
 
 ansible-playbook "playbooks/$ANSIBLE_COMPONENT/playbook.yml" \
-  -i "inventories/$ANSIBLE_ENV.aws_ec2.yml" "$@"
+  -i "inventories/$ANSIBLE_ENV.aws_ec2.yml" \
+  -e "@vars/$ANSIBLE_ENV.yml" "$@"
 status=$?
 
 cd - >/dev/null || exit 1

infrastructure/ssh-keys/2024.enc

@@ -0,0 +1,22 @@
+{
+	"data": "ENC[AES256_GCM,data:yLJKKMQDfmBOJK2H7barHtzBs409ArLqoVHCMsH5Za6GL7aXDpFknwBBK3eVcfhu2EoyfMvEa1NwESeS9zXHiAojepI9XUab+1sdDeCRiHpDTfHOJ1sMcGN0W0lCcMVHAlTx0QLzr+yRSdtXT47n5eZnry+OiFkS9dFvbvgi5oD92sXFc4oZfpURA9knrC3nhZ5yIpqLRVmFoaaBARHzFvfpkNvSE4utMNDfjac5WPpnCW5Er6WmI9l5HhGHHOZ5R5sr01/sPmOs1Kb7ngyylqtPd3Qb4++tC0w+6bJ0HSpO3puUCafXsX5orLIm5/NIRr/88QQkrGhpbaoAu+ux7XpfBHZSsEu031yB35Ta+V/h7pD901xB1upHj6kYsrhNppwsJ8q8vvguBSV7wOYFL1szO0rn1i/Jpbm1ylGgnvJUllSjmSzW3eu9AT1gLb2bAezkKwOLoIOKxXZ7oYtYR35A1enL3e+zTkVzKb08S25/p3bNpQQykfA9E6j65xrYOwk+dZoQWBTXmI3Uv0pdRNWaHUJ1vm7++MAL,iv:u53h/ZstYHxaDk5JSzFlmDW8ZX5u9qOnaXIDVtvhqdA=,tag:knbjRmPr3rpYFz9yoTOE4A==,type:str]",
+	"sops": {
+		"kms": [
+			{
+				"arn": "arn:aws:kms:us-east-1:763640948377:alias/ddays-app",
+				"created_at": "2024-12-22T17:43:09Z",
+				"enc": "AQICAHgdcjswtFLRk2r0EsHvbS93T1AaxRGQ/GRNaO0DtK3p7QH1ZS6BKQ34VK2R61+u2mvHAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMMhi6vL8Qy5Hl7KieAgEQgDs7Ye/qD1E++oDwsbBwe7bf8ogLlbB7ySxGAK+Sb3ltlsSoH9/rSeEurLcxr0kSObNWY0bAVjuq8/skIw==",
+				"aws_profile": "ddays-app"
+			}
+		],
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": null,
+		"lastmodified": "2024-12-22T17:43:10Z",
+		"mac": "ENC[AES256_GCM,data:oaDGQvkb4FukIaCFGJK2gZ7gI0rl+DEEtZqFuGwZ8twPUzFbSOj2BsTA8cLFkE3S19BOs+vr58kbwhbHLZ1BtUfCJn8jo5VxSD35OxcIfKXziFegxbC/ifjQ9WKHPjUPrmI5cQPoQCHR6jIqrU0uV5G736JSwf3RNH3PXrjpN+0=,iv:c8zJy/V33Rg0U7H3N34ZB9xzydpTik1VDkQtR7LZvzM=,tag:pssKNPcKrY9ThMY11+bfeQ==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.9.2"
+	}
+}

infrastructure/ssh-keys/2024.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN6tnUm2i5IBxuyJlfHnqPiQUuEvWq/e3mbBA6LjyTMG ddays-app-2024

infrastructure/terraform/live/2024/compute/.terraform-version

@@ -0,0 +1 @@
+1.5.3

infrastructure/terraform/live/2024/compute/dependencies.tf

@@ -0,0 +1,17 @@
+data "aws_subnets" "public_subnets" {
+  tags = {
+    Project     = "ddays-app"
+    Role        = "public"
+    Environment = "shared"
+    ManagedBy   = "terraform"
+  }
+}
+
+data "aws_security_groups" "public_sg" {
+  tags = {
+    Project     = "ddays-app"
+    Role        = "public"
+    Environment = "shared"
+    ManagedBy   = "terraform"
+  }
+}

infrastructure/terraform/live/2024/compute/main.tf

@@ -0,0 +1,65 @@
+terraform {
+  required_version = ">= 1.0.0, < 2.0.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+
+    cloudflare = {
+      source  = "cloudflare/cloudflare"
+      version = "~> 4.0"
+    }
+
+    sops = {
+      source  = "carlpett/sops"
+      version = "~> 0.5"
+    }
+  }
+
+  backend "s3" {
+    bucket         = "ddays-app-tfstate"
+    dynamodb_table = "ddays-app-tfstate-lock"
+    region         = "us-east-1"
+    profile        = "ddays-app"
+    encrypt        = true
+  }
+}
+
+provider "aws" {
+  region  = "eu-central-1"
+  profile = "ddays-app"
+}
+
+provider "cloudflare" {
+  api_token = data.sops_file.secrets.data["cloudflare_api_token"]
+}
+
+data "cloudflare_zone" "dump_hr" {
+  name = "dump.hr"
+}
+
+data "sops_file" "secrets" {
+  source_file = "secrets.enc.json"
+}
+
+module "web" {
+  source = "../../../modules/ec2"
+
+  name_prefix               = "ddays-app-2024"
+  instance_type             = "t3a.nano"
+  instance_count            = 1
+  instance_root_device_size = 20
+  subnets                   = data.aws_subnets.public_subnets.ids
+  security_groups           = data.aws_security_groups.public_sg.ids
+  ssh_public_key            = file("../../../../ssh-keys/2024.pub")
+  website_domain            = "2024-days.dump.hr"
+  cloudflare_zone_id        = data.cloudflare_zone.dump_hr.id
+
+  tags = {
+    Project     = "ddays-app"
+    Role        = "web"
+    Environment = "2024"
+  }
+}

infrastructure/terraform/live/2024/compute/outputs.tf

@@ -0,0 +1,7 @@
+output "web_ips" {
+  value = module.web.instance_ips
+}
+
+output "web_endpoint" {
+  value = module.web.website_endpoint
+}

infrastructure/terraform/live/2024/compute/secrets.enc.json

@@ -0,0 +1,22 @@
+{
+  "cloudflare_api_token": "ENC[AES256_GCM,data:J0XTy9u44ATF679dk4wtJcT2DYaGJh5276TCdTdJSVBZ4K0eTRKjfQ==,iv:LT6BxJJtvLA6V+HE6hOr9ht4T+R+Z2rPkHxqCI2ml8Q=,tag:rHAyw6/D4bnPmv+XUtuMtQ==,type:str]",
+  "sops": {
+    "kms": [
+      {
+        "arn": "arn:aws:kms:us-east-1:763640948377:alias/ddays-app",
+        "created_at": "2024-01-03T19:59:20Z",
+        "enc": "AQICAHgdcjswtFLRk2r0EsHvbS93T1AaxRGQ/GRNaO0DtK3p7QFoHrUajBHm2HJu58SJAKI1AAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMqAibeTCnVcmKO/KdAgEQgDsjQL/GkUfX3GU5dQQtZb0MMbY2q0fR2wG+Ga0f56lReN/TaMExAapqaW1U/TIRfLLyAppWBNlLK3wzwA==",
+        "aws_profile": "ddays-app"
+      }
+    ],
+    "gcp_kms": null,
+    "azure_kv": null,
+    "hc_vault": null,
+    "age": null,
+    "lastmodified": "2024-01-03T19:59:21Z",
+    "mac": "ENC[AES256_GCM,data:VRIjWvChlyTV3WRgbncZJtinZJD3tl/IxoigD8OcYqvBKDejd7Wwwvhj5DbZDyAJojTbZZPUIgx43xlLprZIteLsh8w2F10Kwa5XaMNa5tcxSf2qvlbxIRiVv27Ci5TITfOADFsXuGqZjZMb3uB60j6Z04Ct4zMgI8fiC+Kx4nY=,iv:CfA4unBFLnPufJ4Dyz56TRw48fzVqS6g3O4UGBN/4ko=,tag:XaUNTJY+zDtD3O4mu6vjkQ==,type:str]",
+    "pgp": null,
+    "unencrypted_suffix": "_unencrypted",
+    "version": "3.7.3"
+  }
+}