@yunuseon/kayra 0.0.0-stage → 0.4.0

package/scripts/server/app-remove

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# =============================================================================
+# app-remove <app> — take an app off this server, keeping its data.
+#
+# Stops its containers and removes everything the platform set up for it:
+# JCasC fragment, secret files, .env, the Jenkins folder with its jobs and
+# history, the release records (so Rollback no longer offers it). Its images
+# are collected by the next registry GC, since the app is no longer registered.
+#
+# Volumes stay: dropping a line from server.yml must never silently destroy a
+# database. `app-purge <app>` deletes them deliberately.
+#
+# Run by `kayra apps` for every registered app missing from server.yml.
+# Installed by the platform role at <platform_dir>/bin. Run as root.
+# =============================================================================
+set -euo pipefail
+
+app="${1:?Usage: app-remove <app>}"
+platform_dir="$(cd "$(dirname "$0")/.." && pwd)"
+apps_dir="$(sed -n 's/^APPS_DIR=//p' "${platform_dir}/.env")"
+
+docker compose -p "$app" down --remove-orphans
+rm -rf "${platform_dir}/jenkins/casc/10-${app}.yaml" \
+       "${platform_dir}/jenkins-secrets/${app}" \
+       "${apps_dir:?}/${app}"
+# Without its fragment the reload drops the app's credentials.
+"${platform_dir}/bin/jenkins-reload"
+"${platform_dir}/bin/jenkins-api" POST "/job/${app}/doDelete" -o /dev/null || true
+(cd "$platform_dir" && docker compose exec -T jenkins-controller rm -rf "/var/jenkins_home/releases/${app}")
+echo "Removed ${app}. Its volumes are kept — app-purge ${app} deletes them."

package/scripts/server/jenkins-api

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# =============================================================================
+# jenkins-api <METHOD> <path> [curl args…] — one authenticated call to the
+# Jenkins API, from inside the controller (admin credentials from its env,
+# CSRF crumb fetched in the same session). Prints the response body.
+#
+#   jenkins-api GET  '/api/json?tree=jobs[name]'
+#   jenkins-api POST /configuration-as-code/reload
+#
+# Installed by the platform role at <platform_dir>/bin.
+# =============================================================================
+set -euo pipefail
+
+method="${1:?Usage: jenkins-api <METHOD> <path> [curl args…]}"
+path="${2:?}"
+shift 2
+
+cd "$(dirname "$0")/.."
+docker compose exec -T jenkins-controller sh -ec '
+    jar=$(mktemp)
+    trap "rm -f $jar" EXIT
+    auth="${JENKINS_ADMIN_USER}:${JENKINS_ADMIN_PASSWORD}"
+    base=http://127.0.0.1:8080
+    crumb=$(curl -sf -c "$jar" -u "$auth" \
+        "$base/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,\":\",//crumb)")
+    method="$1"; path="$2"; shift 2
+    curl -sf -b "$jar" -u "$auth" -H "$crumb" -X "$method" "$base$path" "$@"
+' sh "$method" "$path" "$@"

package/scripts/server/jenkins-app-apply

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# =============================================================================
+# jenkins-app-apply <app> — the one way an app registers with Jenkins.
+#
+# Reads the app's secrets as KEY=VALUE lines on stdin, writes each to
+# jenkins-secrets/<app>/<KEY> (where its 10-<app>.yaml reads them via
+# ${readFile:/run/app-secrets/<app>/<KEY>}), then runs jenkins-reload.
+#
+# Installed by the platform role at <platform_dir>/bin. Run as root.
+# =============================================================================
+set -euo pipefail
+
+app="${1:?Usage: jenkins-app-apply <app> < secrets.env}"
+platform_dir="$(cd "$(dirname "$0")/.." && pwd)"
+secrets_dir="${platform_dir}/jenkins-secrets/${app}"
+
+# Staged next to the target and swapped in whole, so keys the app no longer
+# declares disappear instead of lingering.
+staging="${secrets_dir}.new"
+rm -rf "$staging"
+mkdir -p "$staging"
+trap 'rm -rf "$staging"' EXIT
+while IFS= read -r line || [ -n "$line" ]; do
+    case "$line" in ''|'#'*) continue ;; esac
+    printf '%s' "${line#*=}" > "${staging}/${line%%=*}"
+done
+rm -rf "$secrets_dir"
+mv "$staging" "$secrets_dir"
+trap - EXIT
+# The controller runs as uid 1000 and reads these through a read-only mount.
+chown -R 1000:1000 "$secrets_dir"
+find "$secrets_dir" -type f -exec chmod 0400 {} +
+chmod 0500 "$secrets_dir"
+
+"${platform_dir}/bin/jenkins-reload"
+echo "Applied Jenkins config for ${app}."

package/scripts/server/jenkins-reload

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# =============================================================================
+# jenkins-reload — re-apply every JCasC fragment in jenkins/casc/ in place.
+#
+# Reload, not restart: Jenkins is shared, and recreating the controller for one
+# config change would kill every app's running builds.
+#
+# Installed by the platform role at <platform_dir>/bin.
+# =============================================================================
+set -euo pipefail
+
+"$(dirname "$0")/jenkins-api" POST /configuration-as-code/reload -o /dev/null

package/terraform/modules/hcloud-firewall/main.tf

@@ -0,0 +1,54 @@
+# =============================================================================
+# Hetzner Cloud Firewall Module
+# Creates a firewall with standard web server rules.
+# =============================================================================
+
+terraform {
+  required_providers {
+    hcloud = {
+      source  = "hetznercloud/hcloud"
+      version = "~> 1.45"
+    }
+  }
+}
+
+resource "hcloud_firewall" "this" {
+  name = var.name
+
+  # SSH
+  rule {
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "22"
+    source_ips = var.ssh_allowed_ips
+  }
+
+  # HTTP
+  rule {
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "80"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  # HTTPS
+  rule {
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "443"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  # Anything else the server's kind needs open to the world (e.g. WireGuard).
+  dynamic "rule" {
+    for_each = var.extra_rules
+    content {
+      direction  = "in"
+      protocol   = rule.value.protocol
+      port       = rule.value.port
+      source_ips = ["0.0.0.0/0", "::/0"]
+    }
+  }
+
+  labels = var.labels
+}

package/terraform/modules/hcloud-firewall/outputs.tf

@@ -0,0 +1,9 @@
+output "firewall_id" {
+  description = "Firewall ID"
+  value       = hcloud_firewall.this.id
+}
+
+output "firewall_name" {
+  description = "Firewall name"
+  value       = hcloud_firewall.this.name
+}

package/terraform/modules/hcloud-firewall/variables.tf

@@ -0,0 +1,22 @@
+variable "name" {
+  description = "Firewall name"
+  type        = string
+}
+
+variable "ssh_allowed_ips" {
+  description = "CIDR ranges allowed to SSH (default: anywhere)"
+  type        = list(string)
+  default     = ["0.0.0.0/0", "::/0"]
+}
+
+variable "extra_rules" {
+  description = "Additional inbound rules open to everyone, e.g. [{protocol = \"udp\", port = \"51820\"}]"
+  type        = list(object({ protocol = string, port = string }))
+  default     = []
+}
+
+variable "labels" {
+  description = "Labels to attach to the firewall"
+  type        = map(string)
+  default     = {}
+}

package/terraform/modules/hcloud-server/main.tf

@@ -0,0 +1,62 @@
+# =============================================================================
+# Hetzner Cloud Server Module
+# Provisions a VPS with SSH key and cloud-init.
+# =============================================================================
+
+terraform {
+  required_providers {
+    hcloud = {
+      source  = "hetznercloud/hcloud"
+      version = "~> 1.45"
+    }
+  }
+}
+
+# ---------------------------------------------------------------------------
+# SSH key
+# ---------------------------------------------------------------------------
+resource "hcloud_ssh_key" "deploy" {
+  name       = "${var.name}-deploy"
+  public_key = var.ssh_public_key
+}
+
+# ---------------------------------------------------------------------------
+# Server
+# ---------------------------------------------------------------------------
+resource "hcloud_server" "this" {
+  name        = var.name
+  server_type = var.server_type
+  image       = var.image
+  location    = var.location
+  ssh_keys    = [hcloud_ssh_key.deploy.id]
+
+  firewall_ids = var.firewall_ids
+
+  user_data = templatefile("${path.module}/../../../cloud-init.yml.tpl", {
+    hostname   = var.name
+    ssh_pubkey = var.ssh_public_key
+  })
+
+  labels = var.labels
+
+  # cloud-init runs once, at creation, and Hetzner replaces the server for any
+  # change to these. Editing the template (or adopting a server that was never
+  # created by us) must not destroy it; Ansible converges existing servers.
+  lifecycle {
+    ignore_changes = [user_data, ssh_keys, image]
+  }
+}
+
+# ---------------------------------------------------------------------------
+# Ansible inventory file
+# ---------------------------------------------------------------------------
+resource "local_file" "ansible_inventory" {
+  content = templatefile("${path.module}/templates/inventory.ini.tpl", {
+    hostname     = var.name
+    ssh_host     = hcloud_server.this.ipv4_address
+    ssh_port     = 22
+    ssh_user     = "deploy"
+    ssh_key_path = var.ssh_private_key_path
+  })
+  filename = var.inventory_path
+}

package/terraform/modules/hcloud-server/outputs.tf

@@ -0,0 +1,19 @@
+output "ipv4_address" {
+  description = "Public IPv4 address of the server"
+  value       = hcloud_server.this.ipv4_address
+}
+
+output "server_id" {
+  description = "Hetzner server ID"
+  value       = hcloud_server.this.id
+}
+
+output "server_name" {
+  description = "Server name"
+  value       = hcloud_server.this.name
+}
+
+output "inventory_path" {
+  description = "Path to the generated Ansible inventory"
+  value       = local_file.ansible_inventory.filename
+}

package/terraform/modules/hcloud-server/templates/inventory.ini.tpl

@@ -0,0 +1,5 @@
+[servers]
+${hostname} ansible_host=${ssh_host} ansible_port=${ssh_port} ansible_user=${ssh_user} ansible_ssh_private_key_file=${ssh_key_path}
+
+[servers:vars]
+ansible_ssh_common_args=-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null

package/terraform/modules/hcloud-server/variables.tf

@@ -0,0 +1,50 @@
+variable "name" {
+  description = "Server name"
+  type        = string
+}
+
+variable "server_type" {
+  description = "Hetzner server type (e.g., cx22, cx32)"
+  type        = string
+  default     = "cx22"
+}
+
+variable "image" {
+  description = "OS image"
+  type        = string
+  default     = "ubuntu-24.04"
+}
+
+variable "location" {
+  description = "Hetzner datacenter location"
+  type        = string
+  default     = "nbg1"
+}
+
+variable "ssh_public_key" {
+  description = "SSH public key for the deploy user"
+  type        = string
+}
+
+variable "ssh_private_key_path" {
+  description = "Path to the SSH private key (for inventory generation)"
+  type        = string
+}
+
+variable "firewall_ids" {
+  description = "List of firewall IDs to attach"
+  type        = list(number)
+  default     = []
+}
+
+variable "labels" {
+  description = "Labels to attach to the server"
+  type        = map(string)
+  default     = {}
+}
+
+variable "inventory_path" {
+  description = "Path to write the Ansible inventory file"
+  type        = string
+  default     = "./inventory.ini"
+}

package/terraform/modules/multipass-instance/main.tf

@@ -0,0 +1,67 @@
+# =============================================================================
+# Multipass Instance Module
+# Provisions a local VM via Multipass with the same cloud-init as production.
+# Generates a dedicated, disposable SSH keypair for the instance — unlike
+# the hcloud-server module, which expects the operator's own persistent key.
+# =============================================================================
+
+terraform {
+  required_providers {
+    multipass = {
+      source = "todoroff/multipass"
+    }
+    tls = {
+      source = "hashicorp/tls"
+    }
+    local = {
+      source = "hashicorp/local"
+    }
+  }
+}
+
+resource "tls_private_key" "deploy" {
+  algorithm = "ED25519"
+}
+
+resource "local_sensitive_file" "private_key" {
+  content         = tls_private_key.deploy.private_key_openssh
+  filename        = "${var.ssh_key_dir}/${var.name}_ed25519"
+  file_permission = "0600"
+}
+
+resource "local_file" "public_key" {
+  content  = tls_private_key.deploy.public_key_openssh
+  filename = "${var.ssh_key_dir}/${var.name}_ed25519.pub"
+}
+
+# ---------------------------------------------------------------------------
+# Instance
+# ---------------------------------------------------------------------------
+resource "multipass_instance" "this" {
+  name   = var.name
+  image  = var.image
+  cpus   = var.cpus
+  memory = var.memory
+  disk   = var.disk
+
+  cloud_init = templatefile("${path.module}/../../../cloud-init.yml.tpl", {
+    hostname   = var.name
+    ssh_pubkey = tls_private_key.deploy.public_key_openssh
+  })
+
+  wait_for_cloud_init = true
+}
+
+# ---------------------------------------------------------------------------
+# Ansible inventory file
+# ---------------------------------------------------------------------------
+resource "local_file" "ansible_inventory" {
+  content = templatefile("${path.module}/templates/inventory.ini.tpl", {
+    hostname     = var.name
+    ssh_host     = multipass_instance.this.ipv4[0]
+    ssh_port     = 22
+    ssh_user     = "deploy"
+    ssh_key_path = local_sensitive_file.private_key.filename
+  })
+  filename = var.inventory_path
+}

package/terraform/modules/multipass-instance/outputs.tf

@@ -0,0 +1,19 @@
+output "ipv4_address" {
+  description = "Primary IPv4 address of the instance"
+  value       = multipass_instance.this.ipv4[0]
+}
+
+output "instance_name" {
+  description = "Multipass instance name"
+  value       = multipass_instance.this.name
+}
+
+output "inventory_path" {
+  description = "Path to the generated Ansible inventory"
+  value       = local_file.ansible_inventory.filename
+}
+
+output "ssh_private_key_path" {
+  description = "Path to the generated SSH private key"
+  value       = local_sensitive_file.private_key.filename
+}

package/terraform/modules/multipass-instance/templates/inventory.ini.tpl

@@ -0,0 +1,5 @@
+[servers]
+${hostname} ansible_host=${ssh_host} ansible_port=${ssh_port} ansible_user=${ssh_user} ansible_ssh_private_key_file=${ssh_key_path}
+
+[servers:vars]
+ansible_ssh_common_args=-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null

package/terraform/modules/multipass-instance/variables.tf

@@ -0,0 +1,39 @@
+variable "name" {
+  description = "Instance name"
+  type        = string
+}
+
+variable "image" {
+  description = "Multipass image alias"
+  type        = string
+  default     = "24.04"
+}
+
+variable "cpus" {
+  description = "Virtual CPU count"
+  type        = number
+  default     = 2
+}
+
+variable "memory" {
+  description = "Memory size (e.g. 4G)"
+  type        = string
+  default     = "2G"
+}
+
+variable "disk" {
+  description = "Disk size (e.g. 20G)"
+  type        = string
+  default     = "10G"
+}
+
+variable "ssh_key_dir" {
+  description = "Directory to write the generated SSH keypair into"
+  type        = string
+}
+
+variable "inventory_path" {
+  description = "Path to write the Ansible inventory file"
+  type        = string
+  default     = "./inventory.ini"
+}