47aea569ed
Terraform config under terraform/ manages the two existing VPS hosts and hands the app to docker-compose, with local state: - prod: the new 48GB/12-core VPS (release branch, thermograph.org), sized larger. - beta: the old VPS 75.119.132.91 (main branch, testing tier), no public domain. - The LAN dev box stays on deploy/deploy-dev.sh (dev branch) — out of Terraform. A reusable module (modules/thermograph-host) SSHes each host to install docker/ compose/ufw (+ Caddy when a domain is set), sync the checkout to the host's branch, render /etc/thermograph.env from Terraform variables (secrets pushed via provisioner content, never on local disk), `docker compose up -d`, and health-check. Named volumes are preserved on re-apply, so the Postgres data is never recreated. Container resources are now env-driven in docker-compose.yml (APP_CPUS/DB_CPUS/ DB_MEMORY/WORKERS) with unchanged defaults, so Terraform can size each host.
55 lines
2.1 KiB
HCL
55 lines
2.1 KiB
HCL
locals {
|
|
# Repo root (one level above this terraform/ dir). The module hashes the compose
|
|
# files here so a compose change re-triggers the remote deploy, and this is the
|
|
# tree the host's checkout mirrors over git.
|
|
repo_root = abspath("${path.root}/..")
|
|
}
|
|
|
|
# One module instance per host. The module is entirely SSH-provisioner driven — it
|
|
# configures an already-existing VPS and hands the app off to docker compose.
|
|
module "host" {
|
|
source = "./modules/thermograph-host"
|
|
for_each = var.hosts
|
|
|
|
# Per-host config
|
|
name = each.key
|
|
host = each.value.host
|
|
ssh_user = each.value.ssh_user
|
|
ssh_private_key_path = each.value.ssh_private_key_path
|
|
role = each.value.role
|
|
git_branch = each.value.git_branch
|
|
domain = each.value.domain
|
|
compose_files = each.value.compose_files
|
|
app_dir = each.value.app_dir
|
|
workers = each.value.workers
|
|
app_cpus = each.value.app_cpus
|
|
db_cpus = each.value.db_cpus
|
|
db_memory = each.value.db_memory
|
|
|
|
# Shared infra config
|
|
repo_root = local.repo_root
|
|
repo_url = var.repo_url
|
|
app_port = var.app_port
|
|
|
|
# Shared secrets -> /etc/thermograph.env
|
|
postgres_password = var.postgres_password
|
|
auth_secret = var.auth_secret
|
|
vapid_private_key = var.vapid_private_key
|
|
vapid_public_key = var.vapid_public_key
|
|
vapid_contact = var.vapid_contact
|
|
google_verify = var.google_verify
|
|
bing_verify = var.bing_verify
|
|
mail_backend = var.mail_backend
|
|
smtp_host = var.smtp_host
|
|
smtp_port = var.smtp_port
|
|
smtp_user = var.smtp_user
|
|
smtp_password = var.smtp_password
|
|
smtp_starttls = var.smtp_starttls
|
|
mail_from = var.mail_from
|
|
mail_reply_to = var.mail_reply_to
|
|
discord_webhook = var.discord_webhook
|
|
discord_public_key = var.discord_public_key
|
|
discord_app_id = var.discord_app_id
|
|
discord_bot_token = var.discord_bot_token
|
|
discord_client_secret = var.discord_client_secret
|
|
}
|