asxpi/iac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Infrastructure as Code of asxp.io https://asxp.io
28 commits 3 branches 0 tags 428 KiB
  • Jinja 44.8%
  • Python 34.6%
  • HCL 20.6%
Find a file
Sergei Poljanski 8d2125ae31 nixos: describe asxpio-services as a NixOS system 
asxpio-services is to move from Debian with Docker to NixOS with
Podman. This is the target system; nothing is switched over yet.

One flake holds what was spread over cloud-init, Ansible roles and
hand-made units: network and WireGuard, users and SSH restrictions,
firewall, the weekly image prune, and the four container stacks
(Paper and Fossils Minecraft, SillyTavern, the Forgejo runner), each
as a systemd unit under Podman. The runner keeps running as a
container and starts jobs through Podman's Docker-compatible socket.

Secrets (WireGuard keys, RCON and CurseForge keys) are encrypted with
sops for the admin's age key and the server's SSH host key, so the
repository holds no plaintext secret and CI needs none of them.

Containers that own data wait for /opt/.restored. On a freshly
installed disk a game server would otherwise generate a new world
exactly where the restore is about to land.

Tried on a throwaway server (.#rehearsal): install with nixos-anywhere
keeping a given host key, secret decryption, all stacks, a real Paper
server stopping with a full save, what CI jobs need from the engine
(short image names, the nix-store volume, service containers by name,
a kaniko build, the socket inside a job), an update over SSH and a
reboot.

migration/ has the scripts that move the data through object storage,
and a workflow builds the system on every push and switches the host
on main.

Assisted-by: Claude:fable-5-2
2026-11-12 17:00:59 +04:00
.forgejo/workflows nixos: describe asxpio-services as a NixOS system 2026-11-12 17:00:59 +04:00
ansible base: drop the one-off crontab migration 2026-11-12 07:01:07 +04:00
nixos nixos: describe asxpio-services as a NixOS system 2026-11-12 17:00:59 +04:00
terraform docs: S3 traffic costs 1.00 now 2026-11-12 16:24:06 +04:00
.gitignore add wg: sanya 2026-04-05 19:17:18 +03:00
README.md docs: describe the servers as they are 2026-11-12 06:47:09 +04:00

README.md

asxp.io infrastructure

Two Hetzner Cloud servers, described by Terraform and configured by Ansible. Pushing to main deploys: a Forgejo Actions workflow applies ansible/site.yaml to both servers.

Servers

Server Size Runs
asxpio-ops 2 vCPU, 4 GB Traefik, Forgejo, crawler-alert; app stacks deployed from their own repos
asxpio-services 8 vCPU, 16 GB Forgejo Actions runner, Minecraft (Paper and Fossils), SillyTavern

Both are reachable for administration only over WireGuard (10.20.0.0/24) or the private network (10.10.0.0/20).

Layout

  • terraform/: servers, network, firewalls, object storage buckets.
  • ansible/site.yaml: everything the pipeline manages (see below).
  • ansible/playbooks/: host bootstrap, run by hand.
  • .forgejo/workflows/deploy.yaml: the pipeline.

What the pipeline manages

Role Host What
base both unattended upgrades, fail2ban, journal size cap, Docker daemon config, weekly image prune
traefik ops reverse proxy, TLS, dashboard on WireGuard
crawler_alert ops daily and weekly crawler report timers
forgejo ops Forgejo at git.asxp.io (git.czsk.it is an alias), SSH passthrough
forgejo_runner services Actions runner and its job labels
sillytavern services SillyTavern on the WireGuard address
minecraft, minecraft_fossils services game servers, daily restart timer

Not managed here: the app stacks on asxpio-ops (asxpio, datacenterbingo, blog, czsk, vhpbot, storage). Each deploys from its own repository into /opt/<app>.

Changing something

  1. Edit the role or variable, for example an image tag in ansible/inventory/group_vars/ or a compose file under ansible/roles/<role>/files/.
  2. Push a branch. The pipeline does a dry run against production.
  3. Merge to main. The pipeline dry-runs again, then applies.

A run with nothing to change touches nothing and restarts nothing.

Things to know:

  • Game servers are saved and stopped with a 120 s timeout before a compose change recreates them.
  • The runner executes the pipeline. A change to it recreates the container mid-job: the change lands, that job is reported as failed, and the next run confirms it.
  • Forgejo restarts on a config change; the job log may pause for a few seconds.

To run it yourself, over WireGuard:

cd ansible
ansible-playbook site.yaml --check --diff      # dry run
ansible-playbook site.yaml --tags traefik      # one service

Secrets

Nothing secret is stored in the clear. Service secrets live in ansible/inventory/group_vars/all/vault.yaml, encrypted with Ansible Vault. The pipeline needs two repository secrets:

  • ANSIBLE_VAULT_PASSWORD: decrypts the vault.
  • SSH_DEPLOY_KEY: private key of user deploy on both servers.

Locally, put the vault password in ansible/.vault_pass (ignored by git).

Bootstrap (by hand)

ansible/playbooks/ holds what is done once per host or can lock you out: WireGuard, SSH hardening, s3fs mounts, swap, user creation. See ansible/README.md.