asxpi/iac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Infrastructure as Code of asxp.io https://asxp.io
30 commits 3 branches 0 tags 428 KiB
  • Jinja 44.8%
  • Python 34.6%
  • HCL 20.6%
Find a file
Sergei Poljanski b7c203814e nixos: never commit the staged host key 
An install reads the server's SSH host key from nixos/extra/, and that
key also decrypts the server's secrets. Ignore the directory, along
with nix build result links.

Assisted-by: Claude:fable-5-2
2026-11-12 17:02:56 +04:00
.forgejo/workflows nixos: describe asxpio-services as a NixOS system 2026-11-12 17:00:59 +04:00
ansible ansible: asxpio-services is managed by NixOS 2026-11-12 17:00:59 +04:00
nixos nixos: never commit the staged host key 2026-11-12 17:02:56 +04:00
terraform docs: S3 traffic costs 1.00 now 2026-11-12 16:24:06 +04:00
.gitignore add wg: sanya 2026-04-05 19:17:18 +03:00
README.md ansible: asxpio-services is managed by NixOS 2026-11-12 17:00:59 +04:00

README.md

asxp.io infrastructure

Two Hetzner Cloud servers, described by Terraform. asxpio-services runs NixOS (nixos/); asxpio-ops runs Debian configured by Ansible (ansible/). Pushing to main deploys both through Forgejo Actions.

Servers

Server Size Runs
asxpio-ops 2 vCPU, 4 GB Traefik, Forgejo, crawler-alert; app stacks deployed from their own repos
asxpio-services 8 vCPU, 16 GB Forgejo Actions runner, Minecraft (Paper and Fossils), SillyTavern

Both are reachable for administration only over WireGuard (10.20.0.0/24) or the private network (10.10.0.0/20).

Layout

  • terraform/: servers, network, firewalls, object storage buckets.
  • nixos/: the whole asxpio-services system as a flake.
  • ansible/site.yaml: everything managed on asxpio-ops.
  • ansible/playbooks/: asxpio-ops bootstrap, run by hand.
  • .forgejo/workflows/: nixos.yaml and deploy.yaml, the pipelines.

What is managed where

What Host Where
OS, users, SSH, WireGuard, firewall services nixos/
CI runner, Minecraft (Paper, Fossils), SillyTavern services nixos/hosts/asxpio-services/
baseline (upgrades, fail2ban, journal, Docker config) ops role base
Traefik, Forgejo, crawler-alert ops roles traefik, forgejo, crawler_alert

Not managed here: the app stacks on asxpio-ops (asxpio, datacenterbingo, blog, czsk, vhpbot, storage). Each deploys from its own repository into /opt/<app>.

Changing something

Edit, push a branch, merge to main.

  • A branch push builds the NixOS system and dry-runs Ansible against asxpio-ops.
  • main then switches asxpio-services to the new system and applies Ansible to asxpio-ops.

A run with nothing to change restarts nothing. A change to the CI runner restarts the runner under its own job: the change lands, that job is reported as failed, and the next run confirms it. Details are in nixos/README.md and ansible/README.md.

Secrets

Nothing secret is stored in the clear. asxpio-services secrets are in nixos/secrets/, encrypted with sops; asxpio-ops secrets are in ansible/inventory/group_vars/all/vault.yaml, encrypted with Ansible Vault. The pipelines need two repository secrets:

  • ANSIBLE_VAULT_PASSWORD: decrypts the vault.
  • SSH_DEPLOY_KEY: private key of user deploy on both servers.

Locally, put the vault password in ansible/.vault_pass (ignored by git).

Bootstrap (by hand)

ansible/playbooks/ holds what is done once on asxpio-ops or can lock you out: WireGuard, SSH hardening, swap, user creation. Installing or reinstalling asxpio-services is in nixos/README.md.