feat(deploy): aibook.fun deploy layer (terraform + ansible + docker on DO)

2026-09-02 10:57:09 +02:00
parent 89a3d76122
commit 8ef06cb3e7
21 changed files with 1106 additions and 0 deletions
@@ -0,0 +1,113 @@
+# aibook-fun - Main Infrastructure
+# Managed by OpenTofu
+
+resource "digitalocean_droplet" "web" {
+  name       = "aibook-fun"
+  image      = var.droplet_image
+  size       = var.droplet_size
+  region     = var.region
+  monitoring = true
+  backups    = true
+
+  # CPU/RAM-only resize (provider default is true = also grow the disk).
+  resize_disk = false
+
+  ssh_keys = var.ssh_key_fingerprints
+
+  user_data = templatefile("${path.module}/templates/cloud-init.yaml", {
+    project_name = "aibook_fun"
+  })
+
+  tags = ["aibook-fun", "web", "weown-ai"]
+
+  lifecycle {
+    # A droplet destroy means losing every Docker volume + cert state on it.
+    # make any such plan a hard error instead of an accident.
+    prevent_destroy = true
+    # user_data/tags/ssh_keys are create-time-only on DO; ignore drift so
+    # unrelated changes don't arm `# forces replacement` on next apply.
+    ignore_changes = [user_data, tags, ssh_keys]
+  }
+}
+
+# Optional encrypted-at-rest data volume (default 0 = stateless: droplet local
+# disk only). Enable by setting data_volume_size_gb > 0 if the site ever needs
+# durable state; DO block storage is encrypted at rest, the droplet disk is not.
+resource "digitalocean_volume" "data" {
+  count                   = var.data_volume_size_gb > 0 ? 1 : 0
+  region                  = var.region
+  name                    = "aibook-fun-data"
+  size                    = var.data_volume_size_gb
+  initial_filesystem_type = "ext4"
+  description             = "aibook-fun encrypted-at-rest data (docker data-root)"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "digitalocean_volume_attachment" "data" {
+  count      = var.data_volume_size_gb > 0 ? 1 : 0
+  droplet_id = digitalocean_droplet.web.id
+  volume_id  = digitalocean_volume.data[0].id
+}
+
+resource "digitalocean_reserved_ip" "web" {
+  region = var.region
+}
+
+resource "digitalocean_reserved_ip_assignment" "web" {
+  ip_address = digitalocean_reserved_ip.web.ip_address
+  droplet_id = digitalocean_droplet.web.id
+}
+
+#trivy:ignore:AVD-DIG-0001  # Public web server: HTTP/HTTPS inbound from internet is required by design
+#trivy:ignore:AVD-DIG-0003  # Public web server: unrestricted outbound required for package installs, ACME, image pulls
+resource "digitalocean_firewall" "web" {
+  name        = "aibook-fun-fw"
+  droplet_ids = [digitalocean_droplet.web.id]
+
+  # SSH — restrict via var.ssh_source_cidrs. ⚠️ PRODUCTION: pin to admin IP/32 or VPN
+  inbound_rule {
+    protocol         = "tcp"
+    port_range       = "22"
+    source_addresses = var.ssh_source_cidrs
+  }
+
+  # HTTP (ACME challenge + redirect)
+  inbound_rule {
+    protocol         = "tcp"
+    port_range       = "80"
+    source_addresses = ["0.0.0.0/0", "::/0"]
+  }
+
+  # HTTPS
+  inbound_rule {
+    protocol         = "tcp"
+    port_range       = "443"
+    source_addresses = ["0.0.0.0/0", "::/0"]
+  }
+
+  # HTTPS/QUIC (HTTP/3)
+  inbound_rule {
+    protocol         = "udp"
+    port_range       = "443"
+    source_addresses = ["0.0.0.0/0", "::/0"]
+  }
+
+  # All outbound TCP (apt, ACME, container image pulls)
+  outbound_rule {
+    protocol              = "tcp"
+    port_range            = "1-65535"
+    destination_addresses = ["0.0.0.0/0", "::/0"]
+  }
+
+  # All outbound UDP (DNS, NTP, QUIC)
+  outbound_rule {
+    protocol              = "udp"
+    port_range            = "1-65535"
+    destination_addresses = ["0.0.0.0/0", "::/0"]
+  }
+
+  tags = ["aibook-fun"]
+}