asxpi/iac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Infrastructure as Code of asxp.io https://asxp.io
28 commits 2 branches 0 tags 333 KiB
  • Python 44.6%
  • Jinja 29.1%
  • HCL 26.3%
Find a file
Sergei Poljanski 59b5b4468a ansible: nightly restic backups to both object storage regions 
Hetzner's server backups cost 20% of each server's price and only
restore whole disks. Back up what matters with restic instead, into the
backup buckets we already pay for: one repository per host in hel1
(asxpio-backups-main) and one in fsn1 (asxpio-backups-repl), written
independently so either region alone is a full copy.

Postgres goes in as a dump, Forgejo's and vhpbot's SQLite databases
through the online backup API, Garage with a fresh metadata snapshot,
ejabberd through its own backup command. Keeps 7 daily, 4 weekly and
6 monthly snapshots, prunes on Sundays, and mails the journal when a
run fails.

restic is the pinned upstream release, so its version is tracked in
the repo like everything else. The vault gains the restic password
and the Xray config for the role that follows.

Assisted-by: Claude:opus-5-5
2026-11-12 20:53:44 +04:00
.forgejo/workflows ci: deploy site.yaml from Forgejo Actions 2026-11-12 06:47:09 +04:00
ansible ansible: nightly restic backups to both object storage regions 2026-11-12 20:53:44 +04:00
terraform docs: S3 traffic costs 1.00 now 2026-11-12 16:24:06 +04:00
.gitignore add wg: sanya 2026-04-05 19:17:18 +03:00
README.md docs: describe the servers as they are 2026-11-12 06:47:09 +04:00

README.md

asxp.io infrastructure

Two Hetzner Cloud servers, described by Terraform and configured by Ansible. Pushing to main deploys: a Forgejo Actions workflow applies ansible/site.yaml to both servers.

Servers

Server Size Runs
asxpio-ops 2 vCPU, 4 GB Traefik, Forgejo, crawler-alert; app stacks deployed from their own repos
asxpio-services 8 vCPU, 16 GB Forgejo Actions runner, Minecraft (Paper and Fossils), SillyTavern

Both are reachable for administration only over WireGuard (10.20.0.0/24) or the private network (10.10.0.0/20).

Layout

  • terraform/: servers, network, firewalls, object storage buckets.
  • ansible/site.yaml: everything the pipeline manages (see below).
  • ansible/playbooks/: host bootstrap, run by hand.
  • .forgejo/workflows/deploy.yaml: the pipeline.

What the pipeline manages

Role Host What
base both unattended upgrades, fail2ban, journal size cap, Docker daemon config, weekly image prune
traefik ops reverse proxy, TLS, dashboard on WireGuard
crawler_alert ops daily and weekly crawler report timers
forgejo ops Forgejo at git.asxp.io (git.czsk.it is an alias), SSH passthrough
forgejo_runner services Actions runner and its job labels
sillytavern services SillyTavern on the WireGuard address
minecraft, minecraft_fossils services game servers, daily restart timer

Not managed here: the app stacks on asxpio-ops (asxpio, datacenterbingo, blog, czsk, vhpbot, storage). Each deploys from its own repository into /opt/<app>.

Changing something

  1. Edit the role or variable, for example an image tag in ansible/inventory/group_vars/ or a compose file under ansible/roles/<role>/files/.
  2. Push a branch. The pipeline does a dry run against production.
  3. Merge to main. The pipeline dry-runs again, then applies.

A run with nothing to change touches nothing and restarts nothing.

Things to know:

  • Game servers are saved and stopped with a 120 s timeout before a compose change recreates them.
  • The runner executes the pipeline. A change to it recreates the container mid-job: the change lands, that job is reported as failed, and the next run confirms it.
  • Forgejo restarts on a config change; the job log may pause for a few seconds.

To run it yourself, over WireGuard:

cd ansible
ansible-playbook site.yaml --check --diff      # dry run
ansible-playbook site.yaml --tags traefik      # one service

Secrets

Nothing secret is stored in the clear. Service secrets live in ansible/inventory/group_vars/all/vault.yaml, encrypted with Ansible Vault. The pipeline needs two repository secrets:

  • ANSIBLE_VAULT_PASSWORD: decrypts the vault.
  • SSH_DEPLOY_KEY: private key of user deploy on both servers.

Locally, put the vault password in ansible/.vault_pass (ignored by git).

Bootstrap (by hand)

ansible/playbooks/ holds what is done once per host or can lock you out: WireGuard, SSH hardening, s3fs mounts, swap, user creation. See ansible/README.md.