Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/politician/romain-infra
My automation for provisioning cloud resources for my personal usage.
https://github.com/politician/romain-infra
Last synced: about 2 months ago
JSON representation
My automation for provisioning cloud resources for my personal usage.
- Host: GitHub
- URL: https://github.com/politician/romain-infra
- Owner: politician
- License: apache-2.0
- Created: 2022-02-21T04:20:36.000Z (almost 3 years ago)
- Default Branch: main
- Last Pushed: 2023-12-15T08:27:37.000Z (about 1 year ago)
- Last Synced: 2024-10-18T22:46:41.486Z (3 months ago)
- Language: HCL
- Homepage:
- Size: 33.2 KB
- Stars: 2
- Watchers: 2
- Forks: 0
- Open Issues: 2
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Romain's infra
Manages overarching cloud resources for my personal usage.
> This repo is part of my journey to use git as the source of truth for everything I can automate.
## Projects
### Romain's infrastructure
This repo.
### Barissat's infrastructure
[Repo](https://github.com/politician/barissat-infra) to manage cloud resources for my family usage.
### Domain names manager
My domain names configuration is in a private repo and is automatically synced to the various domain providers using GitHub Actions.
However, several providers require for requests to come from a fixed IP address which is why I decided to use a hosted Github Runner on Digital Ocean.
## Cloud providers
### AWS
To access sub-accounts via the AWS console, login to AWS as the global user and switch role.
Global user credentials:
- Sign-in URL: `terraform output --raw global_aws_signin_url`
- Username: `terraform output --raw global_aws_user_name`
- Password: `terraform output --raw global_aws_user_password | base64 --decode | gpg --decrypt`
Switch role information:
- Account: Copy the desired sub-account ID from [the organization page](https://us-east-1.console.aws.amazon.com/organizations/v2/home/accounts)
- Role: `OrganizationAccountAccessRole`
### Google KMS
In order to sign/verify/encrypt stuff across various projects, I use Google KMS.
## Forking
If you want to fork this repo and modify it for your own personal/commercial usage, please do so freely, it is licensed accordingly (Apache 2.0).
## First-time setup
The way to set it up for the first time is:
1. Rename the project `romain-infra` to your liking, this is the main project (this repo).
2. Remove the other projects
3. Login to the various cloud providers or set environment variables accordingly (most likely as root/admin user)
4. Run `terraform init`
5. If you forked the repo, rename it accordingly and then import it with (replace `romain-infra` accordingly):
```sh
terraform import module.romain-infra.github_repository.github[\"main\"] romain-infra
```
6. Run `terraform apply`
7. This will create the main project and some global credentials for clouds that support it (AWS/GCP), and set them up in Terraform Cloud.
8. Upload the state to Terraform Cloud:
1. Uncomment the lines in `_backend.tf` and modify accordingly
2. Run `terraform init`
3. Answer that you want to copy the state in the prompt
9. Commit and push your work.
10. The plan in Terraform Cloud should run smoothly and display that no changes were detected.
## Ongoing changes
Make modifications/add your projects through pull requests if you want to get speculative plans before merging.
### GitHub runner
#### Create registration token for a repo
Change directory to the repo and then run: (or replace `{owner}/{repo}`)
```sh
gh api -p everest -X POST repos/{owner}/{repo}/actions/runners/registration-token | jq .token
```
#### Create registration token for an org
Change directory to a repo of the org and then run: (or replace `{owner}`)
```sh
gh api -p everest -X POST orgs/{owner}/actions/runners/registration-token | jq .token
```