a26ca72834
Get the 45-year historical record off the rate-limited public Open-Meteo archive API by running a private Open-Meteo instance that serves the era5_seamless blend (0.1° ERA5-Land + 0.25° ERA5 for gusts) from the compressed .om archive in object storage, mounted on the host with rclone. - climate.py: make ARCHIVE_URL env-driven (THERMOGRAPH_ARCHIVE_URL) and pin models=era5_seamless on the archive fetches only, so a self-hosted instance serves the same 0.1° resolution; forecast path unchanged. The public API's default is already seamless, so dev/beta (URL unset) behave identically. - docker-compose.openmeteo.yml: open-meteo-api + two rolling sync workers (era5_land 0.1°, era5 0.25° for gusts), bind-mounting the object-storage mount; the overlay points the app at the local instance. - Makefile: om-up / om-down / om-backfill (one-time full-history backfill). - Terraform: per-host openmeteo flag layers the overlay, renders OM_DATA_DIR, and provisions the host rclone systemd mount from the bucket credentials. - deploy/openmeteo: operator runbook + rclone mount unit template.
213 lines
8 KiB
HCL
213 lines
8 KiB
HCL
# ---------------------------------------------------------------------------------
|
|
# Hosts
|
|
# ---------------------------------------------------------------------------------
|
|
# One entry per VPS. The same module is instantiated for each (see main.tf's
|
|
# for_each). This config manages TWO hosts: prod (new 48 GB / 12-core VPS, branch
|
|
# `release`, thermograph.org) and beta (the old VPS 75.119.132.91, branch `main`,
|
|
# no public domain by default). The `dev` branch deploys to the LAN dev server via
|
|
# deploy/deploy-dev.sh (a self-hosted runner) and is NOT managed here.
|
|
#
|
|
# A host with `domain = ""` gets no Caddy/TLS: the app port is opened on the firewall
|
|
# and the app is reached directly (beta does this by default; set a domain to front
|
|
# it with Caddy TLS).
|
|
#
|
|
# Resource sizing (workers / app_cpus / db_cpus / db_memory) defaults to the historical
|
|
# 4 / 4 / 2 / 8g budget (right for beta). The prod box is 48 GB / 12 cores — raise these
|
|
# there (the example uses app_cpus 8, db_cpus 4, db_memory "16g"); also raise the
|
|
# Postgres *internal* budget in deploy/db/init/20-tuning.sql to actually exploit the RAM.
|
|
variable "hosts" {
|
|
description = "Map of hosts to manage, keyed by a short name (e.g. \"prod\", \"dev\")."
|
|
type = map(object({
|
|
host = string # IP or hostname to SSH to
|
|
ssh_user = optional(string, "deploy") # SSH login user
|
|
ssh_private_key_path = string # path to the private key for that user
|
|
role = string # "prod" | "dev" (informational + outputs)
|
|
git_branch = string # branch the checkout is reset to
|
|
domain = optional(string, "") # public domain; "" => no Caddy/TLS
|
|
compose_files = optional(list(string), ["docker-compose.yml"])
|
|
app_dir = optional(string, "/opt/thermograph") # checkout path on the host
|
|
workers = optional(number, 4) # uvicorn workers (WORKERS)
|
|
app_cpus = optional(number, 4) # app container CPU cap (APP_CPUS)
|
|
db_cpus = optional(number, 2) # db container CPU cap (DB_CPUS)
|
|
db_memory = optional(string, "8g") # db container memory cap (DB_MEMORY)
|
|
# Self-host the ERA5 archive (docker-compose.openmeteo.yml + a host rclone mount
|
|
# of the object-storage bucket). Only the self-hosting host (prod) sets true.
|
|
openmeteo = optional(bool, false)
|
|
om_data_dir = optional(string, "/mnt/om-archive") # host rclone mount point (OM_DATA_DIR)
|
|
}))
|
|
}
|
|
|
|
variable "repo_url" {
|
|
description = "Git remote to clone from when a host has no checkout yet (a fresh prod box)."
|
|
type = string
|
|
default = "https://github.com/griffemi/thermograph.git"
|
|
}
|
|
|
|
variable "app_port" {
|
|
description = "Port the app binds inside the container / is health-checked on."
|
|
type = number
|
|
default = 8137
|
|
}
|
|
|
|
# ---------------------------------------------------------------------------------
|
|
# Self-hosted Open-Meteo (object storage) — consumed only by hosts with openmeteo=true
|
|
# ---------------------------------------------------------------------------------
|
|
# The ERA5 .om archive lives in an object-storage bucket, surfaced on the host by an
|
|
# rclone FUSE mount at each host's om_data_dir. These describe that bucket + mount.
|
|
# om_rclone_conf holds credentials, so it's sensitive and lands in state — keep the
|
|
# real value in terraform.tfvars (gitignored), never committed.
|
|
variable "om_bucket_remote" {
|
|
description = "rclone remote:path for the archive bucket, e.g. \"om-archive:thermograph-era5\" (matches a [remote] in om_rclone_conf)."
|
|
type = string
|
|
default = ""
|
|
}
|
|
|
|
variable "om_rclone_conf" {
|
|
description = "Full rclone.conf contents defining the archive remote (installed to /etc/rclone/rclone.conf, 0600). Sensitive."
|
|
type = string
|
|
default = ""
|
|
sensitive = true
|
|
}
|
|
|
|
variable "om_vfs_cache_max" {
|
|
description = "rclone --vfs-cache-max-size: bounds the on-disk hot cache for the mount (keep within the disk budget)."
|
|
type = string
|
|
default = "80G"
|
|
}
|
|
|
|
# ---------------------------------------------------------------------------------
|
|
# Shared secrets (rendered into /etc/thermograph.env on every host)
|
|
# ---------------------------------------------------------------------------------
|
|
# These live in terraform.tfvars (gitignored) and land in local state — never commit
|
|
# real values. Every host in this config shares the same secret set; split the config
|
|
# if prod and dev must diverge on a credential.
|
|
variable "postgres_password" {
|
|
description = "PostgreSQL password (initializes the db container AND builds THERMOGRAPH_DATABASE_URL)."
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
variable "auth_secret" {
|
|
description = "THERMOGRAPH_AUTH_SECRET — signs email-confirm / password-reset tokens. Pin it."
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
variable "vapid_private_key" {
|
|
description = "THERMOGRAPH_VAPID_PRIVATE_KEY — signs Web Push. Pin it or existing subscriptions break."
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
variable "vapid_public_key" {
|
|
description = "THERMOGRAPH_VAPID_PUBLIC_KEY — public half of the VAPID pair."
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
variable "vapid_contact" {
|
|
description = "THERMOGRAPH_VAPID_CONTACT — mailto: or https URL sent to push services."
|
|
type = string
|
|
sensitive = true
|
|
default = ""
|
|
}
|
|
|
|
# ---- Optional: search-engine verification -------------------------------------
|
|
variable "google_verify" {
|
|
description = "THERMOGRAPH_GOOGLE_VERIFY — Search Console HTML-tag content value."
|
|
type = string
|
|
sensitive = true
|
|
default = ""
|
|
}
|
|
|
|
variable "bing_verify" {
|
|
description = "THERMOGRAPH_BING_VERIFY — Bing Webmaster msvalidate.01 content value."
|
|
type = string
|
|
sensitive = true
|
|
default = ""
|
|
}
|
|
|
|
# ---- Optional: outbound email (SMTP) ------------------------------------------
|
|
variable "mail_backend" {
|
|
description = "THERMOGRAPH_MAIL_BACKEND — console | smtp | disabled. Empty => unset (console default)."
|
|
type = string
|
|
default = ""
|
|
}
|
|
|
|
variable "smtp_host" {
|
|
description = "THERMOGRAPH_SMTP_HOST (usually 127.0.0.1 for the local Postfix null client)."
|
|
type = string
|
|
default = ""
|
|
}
|
|
|
|
variable "smtp_port" {
|
|
description = "THERMOGRAPH_SMTP_PORT."
|
|
type = string
|
|
default = ""
|
|
}
|
|
|
|
variable "smtp_user" {
|
|
description = "THERMOGRAPH_SMTP_USER (only for a remote relay)."
|
|
type = string
|
|
sensitive = true
|
|
default = ""
|
|
}
|
|
|
|
variable "smtp_password" {
|
|
description = "THERMOGRAPH_SMTP_PASSWORD (only for a remote relay)."
|
|
type = string
|
|
sensitive = true
|
|
default = ""
|
|
}
|
|
|
|
variable "smtp_starttls" {
|
|
description = "THERMOGRAPH_SMTP_STARTTLS — \"1\" to enable. Empty => unset."
|
|
type = string
|
|
default = ""
|
|
}
|
|
|
|
variable "mail_from" {
|
|
description = "THERMOGRAPH_MAIL_FROM — From: header, e.g. \"Thermograph <no-reply@thermograph.org>\"."
|
|
type = string
|
|
default = ""
|
|
}
|
|
|
|
variable "mail_reply_to" {
|
|
description = "THERMOGRAPH_MAIL_REPLY_TO."
|
|
type = string
|
|
default = ""
|
|
}
|
|
|
|
# ---- Optional: Discord --------------------------------------------------------
|
|
variable "discord_webhook" {
|
|
description = "THERMOGRAPH_DISCORD_WEBHOOK — the URL IS the credential."
|
|
type = string
|
|
sensitive = true
|
|
default = ""
|
|
}
|
|
|
|
variable "discord_public_key" {
|
|
description = "THERMOGRAPH_DISCORD_PUBLIC_KEY — verifies interaction requests."
|
|
type = string
|
|
default = ""
|
|
}
|
|
|
|
variable "discord_app_id" {
|
|
description = "THERMOGRAPH_DISCORD_APP_ID."
|
|
type = string
|
|
default = ""
|
|
}
|
|
|
|
variable "discord_bot_token" {
|
|
description = "THERMOGRAPH_DISCORD_BOT_TOKEN — a credential (command registration only)."
|
|
type = string
|
|
sensitive = true
|
|
default = ""
|
|
}
|
|
|
|
variable "discord_client_secret" {
|
|
description = "THERMOGRAPH_DISCORD_CLIENT_SECRET — OAuth2 account linking (a credential)."
|
|
type = string
|
|
sensitive = true
|
|
default = ""
|
|
}
|