feat(deploy): aibook.fun deploy layer (terraform + ansible + docker on DO)

2026-09-02 10:57:09 +02:00
parent 89a3d76122
commit 8ef06cb3e7
21 changed files with 1106 additions and 0 deletions
@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# Run OpenTofu with TF_VAR_* creds injected from Infisical /tofu/.
+# Usage: infisical login && INFISICAL_PROJECT_ID=<id> ./itofu.sh <init|plan|apply|...>
+set -euo pipefail
+
+INFISICAL_PROJECT_ID="${INFISICAL_PROJECT_ID:-}"
+INFISICAL_ENV="${INFISICAL_ENV:-prod}"
+TOFU_PATH="/tofu"
+PLAN_FILE="${WEOWN_TOFU_PLAN:-plan.tfplan}"
+
+: "${INFISICAL_PROJECT_ID:?INFISICAL_PROJECT_ID not set. Export it (e.g. from site.conf) before running itofu.sh.}"
+
+command -v infisical >/dev/null 2>&1 || { echo "ERROR: infisical CLI not found." >&2; exit 1; }
+command -v tofu      >/dev/null 2>&1 || { echo "ERROR: tofu not found." >&2; exit 1; }
+infisical export --projectId="$INFISICAL_PROJECT_ID" --env="$INFISICAL_ENV" --path="$TOFU_PATH" >/dev/null 2>&1 || {
+  echo "ERROR: cannot read $INFISICAL_PROJECT_ID $INFISICAL_ENV $TOFU_PATH — run 'infisical login' and check your access." >&2; exit 1; }
+[ "$#" -ge 1 ] || { echo "usage: ./itofu.sh <init|plan|apply|output|destroy|...> [args]" >&2; exit 1; }
+
+irun() { infisical run --projectId="$INFISICAL_PROJECT_ID" --env="$INFISICAL_ENV" --path="$TOFU_PATH" -- "$@"; }
+
+# S3 backend reads AWS_* env on every state op — so ALL tofu calls go through trun.
+# shellcheck disable=SC2016
+trun() { irun bash -c 'export AWS_ACCESS_KEY_ID="$TF_VAR_spaces_access_key" AWS_SECRET_ACCESS_KEY="$TF_VAR_spaces_secret_key"; exec tofu "$@"' itofu "$@"; }
+
+case "$1" in
+  init)
+    shift
+    # shellcheck disable=SC2016
+    irun bash -c 'export AWS_ACCESS_KEY_ID="$TF_VAR_spaces_access_key" AWS_SECRET_ACCESS_KEY="$TF_VAR_spaces_secret_key"; exec tofu init -reconfigure \
+      -backend-config="sse_customer_key=$TF_VAR_spaces_encryption_key" "$@"' itofu "$@"
+    ;;
+  plan)
+    shift
+    trun plan -out="$PLAN_FILE" "$@"
+    ;;
+  apply)
+    shift
+    if [ "$#" -eq 0 ] && [ -f "$PLAN_FILE" ]; then
+      set +e; trun apply "$PLAN_FILE"; rc=$?; set -e
+      rm -f "$PLAN_FILE"
+      exit "$rc"
+    fi
+    trun apply "$@"
+    ;;
+  *)
+    trun "$@"
+    ;;
+esac