feat: add Docker/OpenTofu deployment and DE/NL routing

2026-07-24 23:10:17 +02:00
parent 57f7b4dedb
commit 12eee8d211
59 changed files with 4452 additions and 148 deletions
@@ -0,0 +1,138 @@
+#cloud-config
+
+package_update: true
+package_upgrade: false
+
+groups:
+  - docker
+
+users:
+  - default
+  - name: ${deploy_user}
+    gecos: Watermaps deployment user
+    shell: /bin/bash
+    lock_passwd: true
+    sudo: "ALL=(ALL) NOPASSWD:ALL"
+    groups:
+      - docker
+      - sudo
+    ssh_authorized_keys:
+      - ${ssh_public_key}
+
+ssh_pwauth: false
+
+packages:
+  - ca-certificates
+  - curl
+  - docker.io
+  - docker-compose-v2
+  - jq
+  - rsync
+
+write_files:
+  - path: /etc/docker/daemon.json
+    owner: root:root
+    permissions: "0644"
+    content: |
+      {
+        "log-driver": "json-file",
+        "log-opts": {
+          "max-size": "10m",
+          "max-file": "3"
+        }
+      }
+
+  - path: /usr/local/sbin/watermaps-prepare-volume
+    owner: root:root
+    permissions: "0755"
+    content: |
+      #!/usr/bin/env bash
+      set -euo pipefail
+
+      mount_path="/srv/watermaps-data"
+      install -d -m 0755 "$mount_path"
+
+      if ! mountpoint -q "$mount_path"; then
+        device=""
+        for attempt in $(seq 1 120); do
+          device="$(lsblk -dnpo NAME,MODEL | awk '$2 == "Volume" { print $1; exit }')"
+          if [ -n "$device" ] && [ -b "$device" ]; then
+            break
+          fi
+          device=""
+          sleep 5
+        done
+
+        if [ -z "$device" ]; then
+          echo "Kein angehängtes Hetzner Cloud Volume gefunden." >&2
+          exit 1
+        fi
+
+        filesystem="$(blkid -o value -s TYPE "$device" || true)"
+        if [ -z "$filesystem" ]; then
+          mkfs.ext4 -F "$device"
+          filesystem="ext4"
+        fi
+
+        if [ "$filesystem" != "ext4" ]; then
+          echo "Unerwartetes Dateisystem auf $device: $filesystem" >&2
+          exit 1
+        fi
+
+        uuid="$(blkid -o value -s UUID "$device")"
+        if ! grep -q "^UUID=$uuid " /etc/fstab; then
+          printf '%s\n' \
+            "UUID=$uuid $mount_path ext4 defaults,nofail,x-systemd.device-timeout=30 0 2" \
+            >> /etc/fstab
+        fi
+
+        mount "$mount_path"
+      fi
+
+      install -d -m 0755 -o ${deploy_user} -g ${deploy_user} \
+        "$mount_path/geofabrik" \
+        "$mount_path/local" \
+        "$mount_path/certbot" \
+        "$mount_path/certbot/www" \
+        "$mount_path/certbot/letsencrypt"
+      chown ${deploy_user}:${deploy_user} "$mount_path"
+
+  - path: /etc/systemd/system/watermaps-volume-setup.service
+    owner: root:root
+    permissions: "0644"
+    content: |
+      [Unit]
+      Description=Prepare persistent Watermaps routing data volume
+      Wants=network-online.target
+      After=network-online.target local-fs.target
+
+      [Service]
+      Type=oneshot
+      ExecStart=/usr/local/sbin/watermaps-prepare-volume
+      RemainAfterExit=yes
+      Restart=on-failure
+      RestartSec=15
+      TimeoutStartSec=0
+
+      [Install]
+      WantedBy=multi-user.target
+
+  - path: /etc/systemd/system/docker.service.d/watermaps-volume.conf
+    owner: root:root
+    permissions: "0644"
+    content: |
+      [Unit]
+      Requires=watermaps-volume-setup.service
+      After=watermaps-volume-setup.service
+
+runcmd:
+  - [install, -d, -m, "0755", -o, ${deploy_user}, -g, ${deploy_user}, /opt/watermaps]
+  - [install, -d, -m, "0755", -o, ${deploy_user}, -g, ${deploy_user}, /opt/watermaps/releases]
+  - [install, -d, -m, "0755", -o, ${deploy_user}, -g, ${deploy_user}, /opt/watermaps/shared]
+  - [install, -d, -m, "0755", -o, ${deploy_user}, -g, ${deploy_user}, /var/www/certbot]
+  - [systemctl, daemon-reload]
+  - [systemctl, enable, --now, watermaps-volume-setup.service]
+  - [systemctl, enable, docker.service]
+  - [systemctl, restart, docker.service]
+
+final_message: "Watermaps host bootstrap completed after $UPTIME seconds."