about summary refs log tree commit diff
path: root/infra
AgeCommit message (Collapse)AuthorFilesLines
2019-12-20 r/237 chore: Significantly restructure folder layoutVincent Ambo36-1698/+0
This moves the various projects from "type-based" folders (such as "services" or "tools") into more appropriate semantic folders (such as "nix", "ops" or "web"). Deprecated projects (nixcon-demo & gotest) which only existed for testing/demonstration purposes have been removed. (Note: *all* builds are broken with this commit)
2019-12-20 r/232 chore(infra/k8s): Run 2 copies of the cgit serverVincent Ambo1-1/+1
It's stateless - yay! Redundancy makes it less likely that downtime occurs during rollouts.
2019-12-20 r/229 feat(infra/k8s): Rewrite cgit URLs by routing them through nginxVincent Ambo3-10/+27
Configures nginx to rewrite all requests to cgit, except for those retrieving static files, to `/depot/`. In combination with the previous commits that apply patches to cgit itself, this effectively means that the depot is rendered on the site root. This is pretty cool: It lets people do stuff like `git clone https://git.tazj.in` and get the depot!
2019-12-20 r/221 feat(infra/k8s): Add cgit to Ingress load balancerVincent Ambo2-2/+11
Apart from the fact that TLS certificate provisioning is very wonky, it seems to be working now. AFAICT the L7 LBs still don't support path rewriting, which means that this is likely not the final configuration and it will move behind nginx instead.
2019-12-20 r/220 fix(infra/k8s): Workaround for nginx crash on pidfile writeVincent Ambo3-2/+8
Newer versions of nginx apparently hard-crash if they can't write a PID file in the current directory. To work around this, some writeable scratch space is created for the nginx daemon to write its PID to.
2019-12-20 r/218 chore(infra/dns): Update state of root-tazj-in record setsVincent Ambo1-14/+19
2019-12-20 r/217 feat(infra/k8s): Deploy sync-gcsr container into cgit podVincent Ambo1-5/+18
This actually works - who would have thought!
2019-12-20 r/210 feat(infra/k8s): Add git cookie secret for repository syncVincent Ambo1-0/+10
2019-12-19 r/207 feat(infra/k8s): Add deployment configuration for cgitVincent Ambo2-0/+51
This is not yet done because repository cloning doesn't work at all, in any way whatsoever.
2019-12-18 r/195 chore(infra/gcp): Allow k8s nodes to access GCSRVincent Ambo1-0/+1
2019-12-18 r/187 chore(infra/k8s): Bump Nixery popularity URLVincent Ambo1-1/+1
2019-12-18 r/186 chore(infra/k8s): Point Nixery at the depot on GCSRVincent Ambo1-2/+2
2019-12-18 r/182 feat(infra/k8s): Provision certificate for git.tazj.inVincent Ambo1-0/+4
2019-12-18 r/181 feat(infra/gcp): Configure source repository for the depotVincent Ambo1-0/+7
2019-12-14 r/143 chore: Remove some configuration from a previous lifeVincent Ambo4-40/+4
2019-12-14 r/136 chore(emacs): Move Nix derivation for building Emacs over from infraVincent Ambo1-138/+0
2019-12-14 r/135 chore(infra/nixos): Remove deprecated local packagesVincent Ambo2-48/+0
2019-12-14 r/134 chore(infra/nixos): Mark folder as "not to be evaluated"Vincent Ambo1-0/+6
2019-12-14 r/132 merge(nixos): Merge (unrelated) NixOS config history into infra/Vincent Ambo19-0/+1315
2019-12-14 chore(nixos): Move NixOS config to infra/nixosVincent Ambo19-0/+1315
2019-11-15 fix(k8s): Adjust blog image name to match new repo layoutVincent Ambo1-1/+1
2019-10-26 r/92 chore(k8s): Bump deployed Nixery versionVincent Ambo1-1/+1
2019-10-25 chore: Bump Nixery version & package set configurationVincent Ambo2-0/+3
2019-09-21 r/86 chore(k8s): Bump deployed Nixery versionVincent Ambo1-1/+1
2019-09-21 r/83 refactor(k8s): Parameterise the nginx versionVincent Ambo2-1/+3
2019-09-04 r/82 fix(k8s): Reinsert passLookup newline after kontemplate trims itVincent Ambo2-1/+2
SSH can not read the key without the trailing newline. Ideally kontemplate would expose a toggle for this.
2019-09-04 fix(k8s): Move nixery-secrets to the correct namespaceVincent Ambo1-6/+5
2019-09-03 feat(k8s): Insert Nixery's secrets via kontemplateVincent Ambo5-4/+25
Instead of having a manually prepared secret, use Cloud KMS (as per the previous commits) to decrypt the in-repo secrets and template them into the Secret resource in Kubernetes. Not all of the values are actually secret, it has thus become a bit easier to edit the known hosts, SSH config and such now.
2019-09-03 feat(gcp): Create Cloud KMS resources for encrypting secretsVincent Ambo1-8/+28
The idea here is to use Cloud KMS and a shell script that mimics 'pass' to trick kontemplate into using Cloud KMS to decrypt secrets.
2019-09-03 chore(gcp): Remove monorepo repositoryVincent Ambo1-5/+0
The repository is now public on Github.
2019-09-03 r/78 chore(k8s): Update deployed Nixery versionVincent Ambo1-1/+1
2019-09-02 r/75 fix(k8s): Add nginx route for load-balancer health checksVincent Ambo3-3/+11
2019-09-02 fix(k8s): nginx does not need to be pinned to gitHEADVincent Ambo1-1/+1
2019-09-02 chore(k8s): Point Nixery at public depot URLVincent Ambo1-2/+1
2019-09-02 feat(k8s): Route oslo.pub to nginx in ingressVincent Ambo1-1/+9
2019-09-02 feat(k8s): Add nginx instance for oslo.pub redirectVincent Ambo3-0/+92
The redirect is currently all that this instance does. It is required because HTTP load balancers in GCP don't support URL rewriting.
2019-09-02 chore(k8s): Provision certificate for oslo.pubVincent Ambo1-0/+5
2019-09-02 chore(infra): Remove NixOS configuration for serversVincent Ambo8-3791/+0
This configuration is no longer in use. The Gemma configuration file has been moved over to the k8s folder from where it will be templated into the actual configuration.
2019-08-27 r/67 feat(k8s): Configure HTTPS ingress for the blogVincent Ambo3-0/+29
Uses Google-managed certificates and an Ingress resource to set up an HTTPS load-balancer. This probably won't be the final version as the GKE Ingress is very limited and can not do things like redirect URLs, which I need to decommission the old setup.
2019-08-27 r/66 feat(k8s): Add Google managed TLS certificatesVincent Ambo2-0/+19
Introduces certificates for tazj.in & www.tazj.in.
2019-08-25 r/58 chore(gcp): Enable Cloud DNS serviceVincent Ambo1-0/+1
2019-08-23 r/56 chore(k8s): More tazblog replicasVincent Ambo1-1/+1
2019-08-19 r/40 feat(infra/k8s): Add in-cluster tazblog deployment via NixeryVincent Ambo2-0/+22
First deployment actually using a Nixery image and `gitHEAD`. This does not actually serve a working blog for various reasons. The current storage mechanism (acid-state) isn't really appropriate anymore and I'll need to change that soon.
2019-08-19 r/39 chore(infra/k8s): Bump Nixery image to Cachix-enabled oneVincent Ambo2-2/+2
2019-08-16 r/37 fix(infra/k8s): Always pull a Nixery imageVincent Ambo1-0/+1
2019-08-16 r/36 feat(infra/k8s): Deploy Nixery instance to clusterVincent Ambo2-0/+80
2019-08-16 r/35 feat(infra/gcp): Add Terraform configuration for GKE & friendsVincent Ambo2-0/+90
Sets up Terraform itself, a GKE cluster, a storage bucket and all the other little things required to get the basics running.
2019-07-02 refactor(infra): Move infrastructure into monorepo structureVincent Ambo12-0/+3872
generated by cgit-pink 1.4.1 (git 2.44.2) at 2024-11-05T10·12+0000