From 20b72f085f1c64ca4529ff377852d35c0077abf7 Mon Sep 17 00:00:00 2001 From: Gleb Koval Date: Fri, 29 Mar 2024 15:24:57 +0000 Subject: [PATCH] Secrets VM: v2 (#50) Closes #44. We'll do a manual migration for stability and simplicity. Reviewed-on: https://git.koval.net/cyclane/kovalhome/pulls/50 --- .github/workflows/infra.yaml | 1 - infra/secrets/0000_proxmox_playbook.yaml | 2 +- infra/secrets/0003_infiscal_playbook.yaml | 5 --- infra/secrets/infisical/.env | 16 ++++----- infra/secrets/infisical/docker-compose.yml | 39 +++++++++++++++++----- 5 files changed, 38 insertions(+), 25 deletions(-) diff --git a/.github/workflows/infra.yaml b/.github/workflows/infra.yaml index 149494b..851b20d 100644 --- a/.github/workflows/infra.yaml +++ b/.github/workflows/infra.yaml @@ -75,7 +75,6 @@ jobs: SMTP_PASSWORD: ${{ secrets.SMTP_PASSWORD }} INFISICAL_ENCRYPTION_KEY: ${{ secrets.INFISICAL_ENCRYPTION_KEY }} INFISICAL_AUTH_SECRET: ${{ secrets.INFISICAL_AUTH_SECRET }} - INFISICAL_MONGO_PASSWORD: ${{ secrets.INFISICAL_MONGO_PASSWORD }} INFISICAL_TOKEN: ${{ secrets.INFISICAL_TOKEN }} INFISICAL_URL: https://secrets.koval.net run: ansible-playbook --inventory ./inventory ${{ steps.playbooks.outputs.to_run }} -vv diff --git a/infra/secrets/0000_proxmox_playbook.yaml b/infra/secrets/0000_proxmox_playbook.yaml index 37d9b94..7e603a6 100644 --- a/infra/secrets/0000_proxmox_playbook.yaml +++ b/infra/secrets/0000_proxmox_playbook.yaml @@ -9,7 +9,7 @@ api_token_secret: "{{ lookup('ansible.builtin.env', 'PROXMOX_TOKEN_SECRET') }}" ssh_public: "{{ lookup('ansible.builtin.env', 'SSH_PUBLIC') }}" vmname: "{{ inventory_hostname | regex_replace('^([^\\.]+)\\..+$', '\\1') }}" - node: pve + node: pve2 module_defaults: community.general.proxmox_kvm: api_user: "{{ api_user }}" diff --git a/infra/secrets/0003_infiscal_playbook.yaml b/infra/secrets/0003_infiscal_playbook.yaml index 20b4e18..70f2920 100644 --- a/infra/secrets/0003_infiscal_playbook.yaml +++ b/infra/secrets/0003_infiscal_playbook.yaml @@ -32,11 +32,6 @@ path: "{{ user.home }}/{{ app }}/.env" regexp: "AUTH_SECRET_VALUE" replace: "{{ lookup('ansible.builtin.env', 'INFISICAL_AUTH_SECRET') }}" - - name: Replace Mongo Password secret - ansible.builtin.replace: - path: "{{ user.home }}/{{ app }}/.env" - regexp: "MONGO_PASSWORD_VALUE" - replace: "{{ lookup('ansible.builtin.env', 'INFISICAL_MONGO_PASSWORD') }}" - name: Replace SMTP Password secret ansible.builtin.replace: path: "{{ user.home }}/{{ app }}/.env" diff --git a/infra/secrets/infisical/.env b/infra/secrets/infisical/.env index f91df1f..46fdc22 100644 --- a/infra/secrets/infisical/.env +++ b/infra/secrets/infisical/.env @@ -8,19 +8,17 @@ ENCRYPTION_KEY=ENCRYPTION_KEY_VALUE # THIS IS A SAMPLE AUTH_SECRET KEY AND SHOULD NEVER BE USED FOR PRODUCTION AUTH_SECRET=AUTH_SECRET_VALUE -# MongoDB -# Backend will connect to the MongoDB instance at connection string MONGO_URL which can either be a ref -# to the MongoDB container instance or Mongo Cloud +# Postgres creds +POSTGRES_PASSWORD=infisical +POSTGRES_USER=infisical +POSTGRES_DB=infisical + # Required -MONGO_URL=mongodb://root:MONGO_PASSWORD_VALUE@mongo:27017/?authSource=admin +DB_CONNECTION_URI=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB} # Redis REDIS_URL=redis://redis:6379 -# Optional credentials for MongoDB container instance and Mongo-Express -MONGO_USERNAME=root -MONGO_PASSWORD=MONGO_PASSWORD_VALUE - # Website URL # Required SITE_URL=https://secrets.koval.net @@ -70,4 +68,4 @@ CLIENT_SECRET_GITLAB_LOGIN= # Other INVITE_ONLY_SIGNUP=true -TELEMETRY_ENABLED=false \ No newline at end of file +TELEMETRY_ENABLED=false diff --git a/infra/secrets/infisical/docker-compose.yml b/infra/secrets/infisical/docker-compose.yml index de38fa6..24fcdcc 100644 --- a/infra/secrets/infisical/docker-compose.yml +++ b/infra/secrets/infisical/docker-compose.yml @@ -1,11 +1,28 @@ version: "3" services: + db-migration: + depends_on: + db: + condition: service_healthy + image: infisical/infisical:latest-postgres + env_file: .env + command: npm run migration:latest + pull_policy: always + networks: + - infisical + backend: restart: unless-stopped depends_on: - - mongo - image: infisical/infisical:latest + db: + condition: service_healthy + redis: + condition: service_started + db-migration: + condition: service_completed_successfully + image: infisical/infisical:latest-postgres + pull_policy: always env_file: .env ports: - 80:8080 @@ -20,14 +37,18 @@ services: ports: - 6379:6379 volumes: - - /mnt/nvme/redis-data:/data + - /mnt/nvme/redis_data:/data - mongo: - image: mongo + db: + image: postgres:14-alpine restart: always env_file: .env - environment: - - MONGO_INITDB_ROOT_USERNAME=${MONGO_USERNAME} - - MONGO_INITDB_ROOT_PASSWORD=${MONGO_PASSWORD} volumes: - - /mnt/nvme/mongo-data:/data/db + - /mnt/nvme/pg_data:/var/lib/postgresql/data + networks: + - infisical + healthcheck: + test: "pg_isready --username=${POSTGRES_USER} && psql --username=${POSTGRES_USER} --list" + interval: 5s + timeout: 10s + retries: 10