[^}]+)\\}"',
+ ],
+ versioningTemplate: '{{#if versioning}}{{{versioning}}}{{else}}semver{{/if}}',
+ },
+ ],
}
diff --git a/rootfs/etc/systemd/system/cloud-compose-mariadb-backup.service b/rootfs/etc/systemd/system/cloud-compose-mariadb-backup.service
new file mode 100644
index 0000000..1337d52
--- /dev/null
+++ b/rootfs/etc/systemd/system/cloud-compose-mariadb-backup.service
@@ -0,0 +1,11 @@
+[Unit]
+Description=Cloud Compose MariaDB Backup
+After=cloud-compose.service
+Wants=cloud-compose.service
+
+[Service]
+Type=oneshot
+User=cloud-compose
+Group=cloud-compose
+EnvironmentFile=/home/cloud-compose/.env
+ExecStart=/bin/bash /home/cloud-compose/mariadb-backup.sh
diff --git a/rootfs/etc/systemd/system/cloud-compose-mariadb-backup.timer b/rootfs/etc/systemd/system/cloud-compose-mariadb-backup.timer
new file mode 100644
index 0000000..ef56532
--- /dev/null
+++ b/rootfs/etc/systemd/system/cloud-compose-mariadb-backup.timer
@@ -0,0 +1,14 @@
+[Unit]
+Description=Run Cloud Compose MariaDB backups nightly
+
+[Timer]
+# 9pm-7am EST, splayed per deployment by systemd's stable random delay.
+OnCalendar=*-*-* 02:00:00
+Persistent=true
+RandomizedDelaySec=10h
+FixedRandomDelay=true
+AccuracySec=1min
+Unit=cloud-compose-mariadb-backup.service
+
+[Install]
+WantedBy=timers.target
diff --git a/rootfs/etc/systemd/system/cloud-compose.service b/rootfs/etc/systemd/system/cloud-compose.service
index d461ffd..ddeecd7 100644
--- a/rootfs/etc/systemd/system/cloud-compose.service
+++ b/rootfs/etc/systemd/system/cloud-compose.service
@@ -4,13 +4,13 @@ PartOf=docker.service
After=docker.service
[Service]
+Type=oneshot
+RemainAfterExit=yes
User=cloud-compose
Group=cloud-compose
EnvironmentFile=/home/cloud-compose/.env
-ExecStart=/mnt/disks/data/up
-ExecStop=/mnt/disks/data/down
-Restart=on-failure
-RestartSec=30s
+ExecStart=/bin/bash /home/cloud-compose/up
+ExecStop=/bin/bash /home/cloud-compose/down
[Install]
WantedBy=multi-user.target
diff --git a/rootfs/etc/systemd/system/vault-agent.service b/rootfs/etc/systemd/system/vault-agent.service
new file mode 100644
index 0000000..e61268d
--- /dev/null
+++ b/rootfs/etc/systemd/system/vault-agent.service
@@ -0,0 +1,16 @@
+[Unit]
+Description=Cloud Compose Vault Agent
+After=network-online.target
+Wants=network-online.target
+ConditionPathExists=/etc/vault-agent.d/cloud-compose.hcl
+
+[Service]
+User=root
+Group=root
+EnvironmentFile=-/etc/default/vault-agent
+ExecStart=/usr/local/bin/vault agent -config=/etc/vault-agent.d/cloud-compose.hcl
+Restart=on-failure
+RestartSec=10s
+
+[Install]
+WantedBy=multi-user.target
diff --git a/rootfs/home/cloud-compose/app-init.sh b/rootfs/home/cloud-compose/app-init.sh
index 6b07650..a34c469 100644
--- a/rootfs/home/cloud-compose/app-init.sh
+++ b/rootfs/home/cloud-compose/app-init.sh
@@ -6,22 +6,22 @@ set -eou pipefail
source /home/cloud-compose/profile.sh
export HOME
-git config --global --add safe.directory "$DOCKER_COMPOSE_DIR"
+# shellcheck disable=SC1091
+source /home/cloud-compose/compose-apps.sh
+
+while read -r app; do
+ if [ -z "$app" ]; then
+ continue
+ fi
-if [ ! -d "$DOCKER_COMPOSE_DIR" ]; then
- echo "Directory '$DOCKER_COMPOSE_DIR' not found. Cloning repository."
- mkdir -p "$DOCKER_COMPOSE_DIR"
- pushd "$DOCKER_COMPOSE_DIR"
- retry_until_success git clone -b "$DOCKER_COMPOSE_BRANCH" "$DOCKER_COMPOSE_REPO" .
- chown -R cloud-compose:cloud-compose .
-else
- pushd "$DOCKER_COMPOSE_DIR"
- retry_until_success git pull origin "$DOCKER_COMPOSE_BRANCH"
-fi
+ clone_or_update_compose_app "$app"
+ source_compose_app_env "$app"
-# set COMPOSE_PROJECT_NAME from value set in cloud-compose
-# sourced from /home/cloud-compose/profile.sh which loads /home/cloud-compose/.env
-update_env COMPOSE_PROJECT_NAME "$COMPOSE_PROJECT_NAME"
-update_env SITE_NAME "$GCP_INSTANCE_NAME"
-retry_until_success /mnt/disks/data/init
-popd
+ pushd "$DOCKER_COMPOSE_DIR" >/dev/null
+ update_env COMPOSE_PROJECT_NAME "$COMPOSE_PROJECT_NAME"
+ update_env SITE_NAME "${CLOUD_COMPOSE_INSTANCE_NAME:-${GCP_INSTANCE_NAME:-$app}}"
+ update_env COMPOSE_BIND_PORT "$COMPOSE_BIND_PORT"
+ run_compose_app_lifecycle "$app" init
+ configure_sitectl_app_features "$app"
+ popd >/dev/null
+done < <(compose_app_names)
diff --git a/rootfs/home/cloud-compose/app-rollout.sh b/rootfs/home/cloud-compose/app-rollout.sh
index 64437bd..4025243 100644
--- a/rootfs/home/cloud-compose/app-rollout.sh
+++ b/rootfs/home/cloud-compose/app-rollout.sh
@@ -5,36 +5,4 @@ set -eou pipefail
# shellcheck disable=SC1091
source /home/cloud-compose/profile.sh
-pushd "$DOCKER_COMPOSE_DIR"
-
-retry_until_success git pull origin "$DOCKER_COMPOSE_BRANCH"
-retry_until_success docker info
-
-# Pull all images and check if any were updated
-shopt -s nullglob
-RESTART=0
-while read -r IMAGE; do
- # Skip empty lines and comments
- if [ -z "$IMAGE" ] || [[ "$IMAGE" =~ ^# ]]; then
- continue
- fi
-
- current_image_id=$(docker images --format "{{.ID}}" "$IMAGE" || echo "")
- retry_until_success docker pull "$IMAGE"
- new_image_id=$(docker images --format "{{.ID}}" "$IMAGE")
-
- if [ "$current_image_id" != "$new_image_id" ]; then
- RESTART=1
- fi
-done < <(grep "image:" ./*.{yml,yaml} 2>/dev/null| awk -F': ' '{print $2}')
-shopt -u nullglob
-
-if [ "$RESTART" -eq 1 ]; then
- SERVICE=$(grep -sl "WorkingDirectory=$DIR" /etc/systemd/system/*.service | xargs basename)
- if [ -n "$SERVICE" ]; then
- echo "Restarting $SERVICE"
- systemctl restart "$SERVICE"
- fi
-fi
-
-popd
+exec bash /home/cloud-compose/compose-dispatch.sh rollout
diff --git a/rootfs/home/cloud-compose/compose-apps.sh b/rootfs/home/cloud-compose/compose-apps.sh
new file mode 100644
index 0000000..77ffb3f
--- /dev/null
+++ b/rootfs/home/cloud-compose/compose-apps.sh
@@ -0,0 +1,220 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+COMPOSE_PROJECTS_FILE="${COMPOSE_PROJECTS_FILE:-/home/cloud-compose/compose-projects.json}"
+COMPOSE_APPS_ENV_DIR="${COMPOSE_APPS_ENV_DIR:-/home/cloud-compose/apps}"
+
+shell_env_line() {
+ local name="$1"
+ local value="$2"
+
+ printf '%s=%q\n' "$name" "$value"
+}
+
+compose_app_names() {
+ jq -r 'keys[]' "$COMPOSE_PROJECTS_FILE"
+}
+
+compose_app_field() {
+ local app="$1"
+ local field="$2"
+
+ jq -r --arg app "$app" --arg field "$field" '.[$app][$field] // ""' "$COMPOSE_PROJECTS_FILE"
+}
+
+compose_app_array() {
+ local app="$1"
+ local field="$2"
+
+ jq -r --arg app "$app" --arg field "$field" '.[$app][$field][]?' "$COMPOSE_PROJECTS_FILE"
+}
+
+compose_app_verify_args() {
+ local app="$1"
+
+ jq -r --arg app "$app" '.[$app].sitectl_verify_args // [] | join(" ")' "$COMPOSE_PROJECTS_FILE"
+}
+
+compose_app_ingress_field() {
+ local app="$1"
+ local field="$2"
+
+ jq -r --arg app "$app" --arg field "$field" '.[$app].ingress[$field] // ""' "$COMPOSE_PROJECTS_FILE"
+}
+
+compose_app_ingress_array() {
+ local app="$1"
+ local field="$2"
+
+ jq -r --arg app "$app" --arg field "$field" '.[$app].ingress[$field] // [] | .[]?' "$COMPOSE_PROJECTS_FILE"
+}
+
+sitectl_truthy() {
+ local value
+ value="$(printf '%s' "${1:-}" | tr '[:upper:]' '[:lower:]')"
+
+ case "$value" in
+ 1 | true | yes | y | on | enabled)
+ return 0
+ ;;
+ *)
+ return 1
+ ;;
+ esac
+}
+
+write_compose_app_env() {
+ local app="$1"
+ local env_file="${COMPOSE_APPS_ENV_DIR}/${app}.env"
+
+ mkdir -p "$COMPOSE_APPS_ENV_DIR"
+ {
+ shell_env_line APP_NAME "$app"
+ shell_env_line DOCKER_COMPOSE_REPO "$(compose_app_field "$app" docker_compose_repo)"
+ shell_env_line DOCKER_COMPOSE_BRANCH "$(compose_app_field "$app" docker_compose_branch)"
+ shell_env_line DOCKER_COMPOSE_DIR "$(compose_app_field "$app" project_dir)"
+ shell_env_line COMPOSE_PROJECT_NAME "$(compose_app_field "$app" compose_project_name)"
+ shell_env_line COMPOSE_BIND_PORT "$(compose_app_field "$app" ingress_port)"
+ shell_env_line SITECTL_CONTEXT_NAME "$(compose_app_field "$app" sitectl_context_name)"
+ shell_env_line SITECTL_PLUGIN "$(compose_app_field "$app" sitectl_plugin)"
+ shell_env_line SITECTL_ENVIRONMENT "$(compose_app_field "$app" sitectl_environment)"
+ shell_env_line SITECTL_VERIFY_ARGS "$(compose_app_verify_args "$app")"
+ } > "$env_file"
+ chown cloud-compose:cloud-compose "$env_file" 2>/dev/null || true
+ chmod 0640 "$env_file"
+}
+
+source_compose_app_env() {
+ local app="$1"
+
+ write_compose_app_env "$app"
+ set -a
+ # shellcheck disable=SC1090
+ source "${COMPOSE_APPS_ENV_DIR}/${app}.env"
+ set +a
+}
+
+target_compose_apps() {
+ local lifecycle="$1"
+ local target="${CLOUD_COMPOSE_APP:-${COMPOSE_APP:-${APP_NAME:-}}}"
+
+ if [ -z "$target" ] && [ "$lifecycle" = "rollout" ]; then
+ target="${CLOUD_COMPOSE_PRIMARY_APP:-}"
+ fi
+
+ if [ -n "$target" ]; then
+ printf '%s\n' "$target"
+ return 0
+ fi
+
+ compose_app_names
+}
+
+clone_or_update_compose_app() {
+ local app="$1"
+
+ source_compose_app_env "$app"
+
+ git config --global --add safe.directory "$DOCKER_COMPOSE_DIR"
+
+ if [ ! -d "$DOCKER_COMPOSE_DIR/.git" ]; then
+ echo "Directory '$DOCKER_COMPOSE_DIR' not found. Cloning repository for ${app}."
+ mkdir -p "$DOCKER_COMPOSE_DIR"
+ pushd "$DOCKER_COMPOSE_DIR" >/dev/null
+ retry_until_success git clone -b "$DOCKER_COMPOSE_BRANCH" "$DOCKER_COMPOSE_REPO" .
+ if [ "$(id -u)" -eq 0 ]; then
+ chown -R cloud-compose:cloud-compose .
+ fi
+ popd >/dev/null
+ else
+ pushd "$DOCKER_COMPOSE_DIR" >/dev/null
+ retry_until_success git pull origin "$DOCKER_COMPOSE_BRANCH"
+ popd >/dev/null
+ fi
+}
+
+configure_sitectl_app_features() {
+ local app="$1"
+ local letsencrypt bot_mitigation mode domain acme_email max_upload_size upload_timeout
+ local configure_ingress=false
+ local changed=false
+ local trusted_ip
+
+ source_compose_app_env "$app"
+
+ letsencrypt="$(compose_app_ingress_field "$app" letsencrypt)"
+ bot_mitigation="$(compose_app_ingress_field "$app" bot_mitigation)"
+ mode="$(compose_app_ingress_field "$app" mode)"
+ domain="$(compose_app_ingress_field "$app" domain)"
+ acme_email="$(compose_app_ingress_field "$app" acme_email)"
+ max_upload_size="$(compose_app_ingress_field "$app" max_upload_size)"
+ upload_timeout="$(compose_app_ingress_field "$app" upload_timeout)"
+
+ if sitectl_truthy "$letsencrypt" && [ -z "$mode" ]; then
+ mode="https-letsencrypt"
+ fi
+
+ local ingress_args=(set ingress enabled --context "$SITECTL_CONTEXT_NAME" --yolo)
+ if [ -n "$mode" ]; then
+ ingress_args+=(--mode "$mode")
+ configure_ingress=true
+ fi
+ if [ -n "$domain" ]; then
+ ingress_args+=(--domain "$domain")
+ configure_ingress=true
+ fi
+ if [ -n "$acme_email" ]; then
+ ingress_args+=(--acme-email "$acme_email")
+ configure_ingress=true
+ fi
+ while IFS= read -r trusted_ip; do
+ if [ -n "$trusted_ip" ]; then
+ ingress_args+=(--trusted-ip "$trusted_ip")
+ configure_ingress=true
+ fi
+ done < <(compose_app_ingress_array "$app" trusted_ips)
+ if [ -n "$max_upload_size" ]; then
+ ingress_args+=(--max-upload-size "$max_upload_size")
+ configure_ingress=true
+ fi
+ if [ -n "$upload_timeout" ]; then
+ ingress_args+=(--upload-timeout "$upload_timeout")
+ configure_ingress=true
+ fi
+
+ if [ "$configure_ingress" = true ]; then
+ sitectl "${ingress_args[@]}"
+ changed=true
+ fi
+ if sitectl_truthy "$bot_mitigation"; then
+ sitectl set bot-mitigation on --context "$SITECTL_CONTEXT_NAME" --yolo
+ changed=true
+ fi
+ if [ "$changed" = true ]; then
+ sitectl converge --context "$SITECTL_CONTEXT_NAME" --yolo
+ fi
+}
+
+run_compose_app_lifecycle() {
+ local app="$1"
+ local lifecycle="$2"
+ local field="${lifecycle}_commands"
+ local command
+
+ if [ "$lifecycle" != "down" ]; then
+ clone_or_update_compose_app "$app"
+ else
+ source_compose_app_env "$app"
+ fi
+
+ echo "Running cloud-compose ${lifecycle} for ${app}"
+ pushd "$DOCKER_COMPOSE_DIR" >/dev/null
+ while IFS= read -r command; do
+ if [ -z "$command" ]; then
+ continue
+ fi
+ bash -c "$command"
+ done < <(compose_app_array "$app" "$field")
+ popd >/dev/null
+}
diff --git a/rootfs/home/cloud-compose/compose-dispatch.sh b/rootfs/home/cloud-compose/compose-dispatch.sh
new file mode 100644
index 0000000..4d3a7a1
--- /dev/null
+++ b/rootfs/home/cloud-compose/compose-dispatch.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+lifecycle="${1:-}"
+if [ -z "$lifecycle" ]; then
+ echo "usage: compose-dispatch.sh init|up|down|rollout" >&2
+ exit 2
+fi
+
+# shellcheck disable=SC1091
+source /home/cloud-compose/profile.sh
+# shellcheck disable=SC1091
+source /home/cloud-compose/compose-apps.sh
+
+case "$lifecycle" in
+ init | up | down | rollout) ;;
+ *)
+ echo "unknown lifecycle: ${lifecycle}" >&2
+ exit 2
+ ;;
+esac
+
+while read -r app; do
+ if [ -z "$app" ]; then
+ continue
+ fi
+ run_compose_app_lifecycle "$app" "$lifecycle"
+done < <(target_compose_apps "$lifecycle")
diff --git a/rootfs/home/cloud-compose/host-conf.sh b/rootfs/home/cloud-compose/host-conf.sh
index 7741ffe..cbc1a0c 100644
--- a/rootfs/home/cloud-compose/host-conf.sh
+++ b/rootfs/home/cloud-compose/host-conf.sh
@@ -5,63 +5,47 @@ set -eou pipefail
# shellcheck disable=SC1091
source /home/cloud-compose/profile.sh
-# block metadata server from docker and non-root
-/sbin/iptables -I FORWARD -d 169.254.169.254/32 -i docker0 -j DROP
-/sbin/iptables -A OUTPUT -m owner ! --uid-owner 0 -d 169.254.169.254/32 -p tcp --dport 80 -j DROP
-
-# restart services we've overwritten files for
-systemctl restart fluent-bit
-systemctl restart docker
-
-# wait until our data-root /etc/docker/daemon.json setting are applied
-until test -d /mnt/disks/data/docker/overlay2; do
- echo "Waiting for docker overlay2 dir"
- sleep 1
-done
-
-mkdir -p /home/cloud-compose/.docker/cli-plugins /home/cloud-compose/bin
+if [ "${CLOUD_COMPOSE_PROVIDER:-}" = "gcp" ]; then
+ # block metadata server from docker and non-root
+ /sbin/iptables -I FORWARD -d 169.254.169.254/32 -i docker0 -j DROP || true
+ /sbin/iptables -A OUTPUT -m owner ! --uid-owner 0 -d 169.254.169.254/32 -p tcp --dport 80 -j DROP || true
+fi
-# since COS is read only FS, install host tools in the home directory
-# and symlink to our data disk which can have executables.
-# A custom COS image could eventually bake these in, but it is unnecessary
-# for this handful of simple creation-time installs.
-if [ ! -f "/home/cloud-compose/.docker/cli-plugins/docker-compose" ]; then
- retry_until_success curl -sSL \
- https://github.com/docker/compose/releases/download/v2.40.3/docker-compose-linux-x86_64 \
- -o /mnt/disks/data/docker-compose
- chmod o+x /mnt/disks/data/docker-compose
- ln -sf /mnt/disks/data/docker-compose /home/cloud-compose/.docker/cli-plugins/docker-compose
+if systemctl list-unit-files fluent-bit.service >/dev/null 2>&1; then
+ systemctl restart fluent-bit || true
fi
-if [ ! -f "/home/cloud-compose/.docker/cli-plugins/docker-buildx" ]; then
- retry_until_success curl -sSL \
- https://github.com/docker/buildx/releases/download/v0.30.1/buildx-v0.30.1.linux-amd64 \
- -o /mnt/disks/data/docker-buildx
- chmod o+x /mnt/disks/data/docker-buildx
- ln -sf /mnt/disks/data/docker-buildx /home/cloud-compose/.docker/cli-plugins/docker-buildx
+bash /home/cloud-compose/install-dependencies.sh
+
+if [ "${CLOUD_COMPOSE_PROVIDER:-}" = "gcp" ]; then
+ # Docker build containers cannot use GCE metadata DNS after we block metadata
+ # access from docker0, so give Docker explicit external resolvers.
+ install -d /etc/docker
+ cat >/etc/docker/daemon.json <<'EOF'
+{
+ "data-root": "/mnt/disks/data/docker",
+ "dns": ["8.8.8.8", "8.8.4.4", "1.1.1.1"]
+}
+EOF
fi
-if [ ! -f "/mnt/disks/data/make" ]; then
- # shellcheck disable=SC2016
- retry_until_success /usr/bin/docker run --rm \
- -v /mnt/disks/data:/out \
- alpine:3.22 \
- /bin/sh -euxc '
- MAKE_VERSION="4.4.1"
- MAKE_SHA256="dd16fb1d67bfab79a72f5e8390735c49e3e8e70b4945a15ab1f81ddb78658fb3"
+# restart services we've overwritten files for
+systemctl restart docker
- apk add --no-cache build-base curl make tar
- curl -fsSL "https://ftp.gnu.org/gnu/make/make-${MAKE_VERSION}.tar.gz" -o /tmp/make.tar.gz
- echo "${MAKE_SHA256} /tmp/make.tar.gz" | sha256sum -c -
- tar -xzf /tmp/make.tar.gz -C /tmp
- cd "/tmp/make-${MAKE_VERSION}"
- LDFLAGS="-static" ./configure --disable-nls
- make -j2
- cp make /out/make
- '
-fi
-chmod o+x /mnt/disks/data/make
-ln -sf /mnt/disks/data/make /home/cloud-compose/bin/make
+# wait until our data-root /etc/docker/daemon.json setting is applied
+deadline=$((SECONDS + 120))
+while [ "$(docker info --format '{{.DockerRootDir}}' 2>/dev/null || true)" != "/mnt/disks/data/docker" ]; do
+ if (( SECONDS >= deadline )); then
+ echo "Docker did not switch to /mnt/disks/data/docker" >&2
+ docker info || true
+ systemctl status docker --no-pager || true
+ cat /etc/docker/daemon.json || true
+ findmnt /mnt/disks/data || true
+ exit 1
+ fi
+ echo "Waiting for docker data-root"
+ sleep 2
+done
bash /home/cloud-compose/libops-managed-runtime.sh install-tools
systemctl daemon-reload
diff --git a/rootfs/home/cloud-compose/host-init.sh b/rootfs/home/cloud-compose/host-init.sh
index 01ade3d..50b50bd 100644
--- a/rootfs/home/cloud-compose/host-init.sh
+++ b/rootfs/home/cloud-compose/host-init.sh
@@ -1,34 +1,53 @@
#!/usr/bin/env bash
-set -euo pipefail
+set -euxo pipefail
cleanup() {
- rm tmp.attr .env.tmp || echo ""
- popd
+ rm -f tmp.attr .env.tmp
+ popd >/dev/null
}
-pushd /home/cloud-compose
+pushd /home/cloud-compose >/dev/null
trap cleanup EXIT
if [ -f .env ]; then
cp .env .env.tmp
+else
+ touch .env .env.tmp
fi
-curl -sf \
- -H "Metadata-Flavor: Google" \
- "http://metadata.google.internal/computeMetadata/v1/?recursive=true" > tmp.attr
+if [ "${CLOUD_COMPOSE_PROVIDER:-}" = "gcp" ]; then
+ curl -sf \
+ -H "Metadata-Flavor: Google" \
+ "http://metadata.google.internal/computeMetadata/v1/?recursive=true" > tmp.attr
-{
- echo "GCP_PUBLIC_IP=$(jq -r '.instance.networkInterfaces[0].accessConfigs[0].externalIp' tmp.attr)"
- echo "GCP_PRIVATE_IP=$(jq -r '.instance.networkInterfaces[0].ip' tmp.attr)"
-} >> .env.tmp
+ {
+ echo "GCP_PUBLIC_IP=$(jq -r '.instance.networkInterfaces[0].accessConfigs[0].externalIp' tmp.attr)"
+ echo "GCP_PRIVATE_IP=$(jq -r '.instance.networkInterfaces[0].ip' tmp.attr)"
+ } >> .env.tmp
+fi
-if ! diff <(md5sum .env.tmp) <(md5sum .env); then
+if ! diff <(md5sum .env.tmp) <(md5sum .env) >/dev/null 2>&1; then
mv .env.tmp .env
+else
+ rm -f .env.tmp
+fi
+
+if [ "${LIBOPS_INTERNAL_SERVICES_ENABLED:-false}" = "true" ]; then
+ install -d -m 0755 /mnt/disks/data/libops-internal
cp .env /mnt/disks/data/libops-internal/
- chown cloud-compose /mnt/disks/data/libops-internal/.env
+ chown cloud-compose:cloud-compose /mnt/disks/data/libops-internal/.env
fi
chown -R cloud-compose:cloud-compose /home/cloud-compose
-usermod -aG docker cloud-compose
+groupadd --force docker
+if ! id -u cloud-compose >/dev/null 2>&1; then
+ useradd --create-home --shell /bin/bash --groups docker cloud-compose
+elif ! id -nG cloud-compose | tr ' ' '\n' | grep -qx docker; then
+ usermod --append --groups docker cloud-compose || {
+ echo "Warning: failed to add cloud-compose to docker group" >&2
+ id cloud-compose >&2 || true
+ getent group docker >&2 || true
+ }
+fi
diff --git a/rootfs/home/cloud-compose/install-dependencies-coreos.sh b/rootfs/home/cloud-compose/install-dependencies-coreos.sh
new file mode 100644
index 0000000..1338cb2
--- /dev/null
+++ b/rootfs/home/cloud-compose/install-dependencies-coreos.sh
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# shellcheck disable=SC1091
+source /home/cloud-compose/profile.sh
+
+install -d /etc/yum.repos.d /usr/local/lib/docker/cli-plugins
+cat >/etc/yum.repos.d/sitectl.repo <<'EOF'
+[sitectl]
+name=sitectl
+baseurl=https://packages.libops.io/sitectl/rpm
+enabled=1
+gpgcheck=0
+repo_gpgcheck=1
+gpgkey=https://packages.libops.io/sitectl/sitectl-archive-keyring.asc
+EOF
+
+bash /home/cloud-compose/install-docker-plugins.sh
+
+packages=()
+for package in git jq make; do
+ if ! rpm -q "$package" >/dev/null 2>&1; then
+ packages+=("$package")
+ fi
+done
+
+for package in ${SITECTL_PACKAGES:-sitectl}; do
+ if [ -n "$package" ] && ! rpm -q "$package" >/dev/null 2>&1; then
+ packages+=("$package")
+ fi
+done
+
+if [ "${#packages[@]}" -gt 0 ]; then
+ rpm-ostree install --apply-live "${packages[@]}"
+fi
diff --git a/rootfs/home/cloud-compose/install-dependencies-cos.sh b/rootfs/home/cloud-compose/install-dependencies-cos.sh
new file mode 100644
index 0000000..ea0c5b1
--- /dev/null
+++ b/rootfs/home/cloud-compose/install-dependencies-cos.sh
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# shellcheck disable=SC1091
+source /home/cloud-compose/profile.sh
+
+mkdir -p "${DOCKER_CONFIG}/cli-plugins" /home/cloud-compose/.docker/cli-plugins /home/cloud-compose/bin /mnt/disks/data
+DOCKER_CLI_PLUGIN_DIR="${DOCKER_CONFIG}/cli-plugins" \
+ bash /home/cloud-compose/install-docker-plugins.sh
+DOCKER_CLI_PLUGIN_DIR=/home/cloud-compose/.docker/cli-plugins \
+ bash /home/cloud-compose/install-docker-plugins.sh
+chown -R cloud-compose:cloud-compose "$DOCKER_CONFIG" /home/cloud-compose/.docker /home/cloud-compose/bin
+
+if [ ! -f "/mnt/disks/data/make" ]; then
+ # COS can start Docker before bridge egress is reliable; this bootstrap container does not run app code.
+ # shellcheck disable=SC2016
+ retry_until_success /usr/bin/docker run --rm \
+ --network host \
+ -v /mnt/disks/data:/out \
+ alpine:3.22 \
+ /bin/sh -euxc '
+ MAKE_VERSION="4.4.1"
+ MAKE_SHA256="dd16fb1d67bfab79a72f5e8390735c49e3e8e70b4945a15ab1f81ddb78658fb3"
+
+ apk add --no-cache build-base curl make tar
+ curl -fsSL "https://ftp.gnu.org/gnu/make/make-${MAKE_VERSION}.tar.gz" -o /tmp/make.tar.gz
+ echo "${MAKE_SHA256} /tmp/make.tar.gz" | sha256sum -c -
+ tar -xzf /tmp/make.tar.gz -C /tmp
+ cd "/tmp/make-${MAKE_VERSION}"
+ LDFLAGS="-static" ./configure --disable-nls
+ make -j2
+ cp make /out/make
+ '
+fi
+chmod a+x /mnt/disks/data/make
+ln -sf /mnt/disks/data/make /home/cloud-compose/bin/make
diff --git a/rootfs/home/cloud-compose/install-dependencies-debian.sh b/rootfs/home/cloud-compose/install-dependencies-debian.sh
new file mode 100644
index 0000000..d8099cb
--- /dev/null
+++ b/rootfs/home/cloud-compose/install-dependencies-debian.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# shellcheck disable=SC1091
+source /home/cloud-compose/profile.sh
+
+export DEBIAN_FRONTEND=noninteractive
+
+retry_until_success apt-get update -qq
+retry_until_success apt-get install -y \
+ ca-certificates \
+ curl \
+ docker.io \
+ git \
+ jq \
+ make
+
+install -d /usr/local/lib/docker/cli-plugins
+bash /home/cloud-compose/install-docker-plugins.sh
+
+systemctl enable docker
diff --git a/rootfs/home/cloud-compose/install-dependencies.sh b/rootfs/home/cloud-compose/install-dependencies.sh
new file mode 100644
index 0000000..c6d837e
--- /dev/null
+++ b/rootfs/home/cloud-compose/install-dependencies.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+if [ -f /etc/os-release ]; then
+ # shellcheck disable=SC1091
+ source /etc/os-release
+fi
+
+os_id="${ID:-unknown}"
+os_id_like="${ID_LIKE:-}"
+variant_id="${VARIANT_ID:-}"
+
+case "$os_id:$variant_id:$os_id_like" in
+ cos:*:*)
+ exec bash /home/cloud-compose/install-dependencies-cos.sh
+ ;;
+ *:coreos:* | fedora:*:*)
+ if command -v rpm-ostree >/dev/null 2>&1; then
+ exec bash /home/cloud-compose/install-dependencies-coreos.sh
+ fi
+ ;;
+ debian:*:* | ubuntu:*:* | *:*:*debian*)
+ exec bash /home/cloud-compose/install-dependencies-debian.sh
+ ;;
+esac
+
+echo "Unsupported OS for cloud-compose dependency installation: ID=${os_id} VARIANT_ID=${variant_id} ID_LIKE=${os_id_like}" >&2
+exit 1
diff --git a/rootfs/home/cloud-compose/install-docker-plugins.sh b/rootfs/home/cloud-compose/install-docker-plugins.sh
new file mode 100644
index 0000000..b6cd6a5
--- /dev/null
+++ b/rootfs/home/cloud-compose/install-docker-plugins.sh
@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# shellcheck disable=SC1091
+source /home/cloud-compose/profile.sh
+
+docker_arch() {
+ case "$(uname -m)" in
+ x86_64 | amd64) echo "x86_64" ;;
+ aarch64 | arm64) echo "aarch64" ;;
+ *)
+ echo "unsupported architecture: $(uname -m)" >&2
+ return 1
+ ;;
+ esac
+}
+
+buildx_arch() {
+ case "$(uname -m)" in
+ x86_64 | amd64) echo "amd64" ;;
+ aarch64 | arm64) echo "arm64" ;;
+ *)
+ echo "unsupported architecture: $(uname -m)" >&2
+ return 1
+ ;;
+ esac
+}
+
+install_docker_cli_plugin() {
+ local name="$1"
+ local url="$2"
+ local path="$3"
+
+ if [ -x "$path" ]; then
+ return 0
+ fi
+
+ mkdir -p "$(dirname "$path")"
+ retry_until_success curl -fsSL "$url" -o "$path"
+ chmod a+x "$path"
+}
+
+install_docker_plugins() {
+ local plugin_dir="${DOCKER_CLI_PLUGIN_DIR:-/usr/local/lib/docker/cli-plugins}"
+ local compose_arch buildx_asset_arch
+
+ # renovate: datasource=github-releases depName=docker-compose packageName=docker/compose versioning=semver
+ DOCKER_COMPOSE_VERSION="${DOCKER_COMPOSE_VERSION:-v5.2.0}"
+ # renovate: datasource=github-releases depName=docker-buildx packageName=docker/buildx versioning=semver
+ DOCKER_BUILDX_VERSION="${DOCKER_BUILDX_VERSION:-v0.35.0}"
+
+ compose_arch="$(docker_arch)"
+ buildx_asset_arch="$(buildx_arch)"
+ install_docker_cli_plugin \
+ docker-compose \
+ "https://github.com/docker/compose/releases/download/${DOCKER_COMPOSE_VERSION}/docker-compose-linux-${compose_arch}" \
+ "${plugin_dir}/docker-compose"
+ install_docker_cli_plugin \
+ docker-buildx \
+ "https://github.com/docker/buildx/releases/download/${DOCKER_BUILDX_VERSION}/buildx-${DOCKER_BUILDX_VERSION}.linux-${buildx_asset_arch}" \
+ "${plugin_dir}/docker-buildx"
+}
+
+install_docker_plugins "$@"
diff --git a/rootfs/home/cloud-compose/mariadb-backup.sh b/rootfs/home/cloud-compose/mariadb-backup.sh
new file mode 100644
index 0000000..7779f9d
--- /dev/null
+++ b/rootfs/home/cloud-compose/mariadb-backup.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# shellcheck disable=SC1091
+source /home/cloud-compose/profile.sh
+# shellcheck disable=SC1091
+source /home/cloud-compose/compose-apps.sh
+
+BACKUP_ROOT="${MARIADB_BACKUP_ROOT:-/mnt/disks/data/backups/mariadb}"
+today="$(date -u +%Y%m%d)"
+
+while read -r app; do
+ if [ -z "$app" ]; then
+ continue
+ fi
+
+ source_compose_app_env "$app"
+ backup_dir="${BACKUP_ROOT}/${app}"
+ mkdir -p "$backup_dir"
+
+ output="${backup_dir}/${today}-${SITECTL_CONTEXT_NAME}.sql.gz"
+ if [ -f "$output" ]; then
+ echo "MariaDB backup already exists for ${app}: ${output}"
+ continue
+ fi
+
+ echo "Running MariaDB backup for ${app}"
+ sitectl mariadb backup \
+ --context "$SITECTL_CONTEXT_NAME" \
+ --gzip \
+ --output "$output"
+done < <(compose_app_names)
diff --git a/rootfs/home/cloud-compose/profile.sh b/rootfs/home/cloud-compose/profile.sh
index 84039ef..ba8cd25 100644
--- a/rootfs/home/cloud-compose/profile.sh
+++ b/rootfs/home/cloud-compose/profile.sh
@@ -1,9 +1,12 @@
#!/usr/bin/env bash
# shellcheck disable=SC1091
+set -a
. /home/cloud-compose/.env
+set +a
export PATH="/home/cloud-compose/bin:$PATH"
+export DOCKER_CONFIG="${DOCKER_CONFIG:-/mnt/disks/data/docker-config}"
DEFAULT_MAX_RETRIES=10
DEFAULT_SLEEP_INCREMENT=5
diff --git a/rootfs/home/cloud-compose/rotate-keys-app.sh b/rootfs/home/cloud-compose/rotate-keys-app.sh
index a791f34..c19840b 100644
--- a/rootfs/home/cloud-compose/rotate-keys-app.sh
+++ b/rootfs/home/cloud-compose/rotate-keys-app.sh
@@ -7,15 +7,28 @@ pushd /home/cloud-compose
# shellcheck disable=SC1091
source /home/cloud-compose/profile.sh
-if [ ! -d "$DOCKER_COMPOSE_DIR/secrets" ]; then
- mkdir -p "$DOCKER_COMPOSE_DIR/secrets"
-fi
+# shellcheck disable=SC1091
+source /home/cloud-compose/compose-apps.sh
+APP_CREDENTIALS_FILE="/mnt/disks/data/cloud-compose/app/GOOGLE_APPLICATION_CREDENTIALS"
+mkdir -p "$(dirname "$APP_CREDENTIALS_FILE")"
bash rotate-keys.sh \
- "$GCP_INSTANCE_NAME@$GCP_PROJECT.iam.gserviceaccount.com" \
+ "$GCP_APP_SERVICE_ACCOUNT_EMAIL" \
"$GCP_PROJECT" \
- "$DOCKER_COMPOSE_DIR/secrets/GOOGLE_APPLICATION_CREDENTIALS"
+ "$APP_CREDENTIALS_FILE"
+
+chgrp cloud-compose "$APP_CREDENTIALS_FILE"
-chgrp cloud-compose "$DOCKER_COMPOSE_DIR/secrets/GOOGLE_APPLICATION_CREDENTIALS"
+while read -r app; do
+ if [ -z "$app" ]; then
+ continue
+ fi
+
+ source_compose_app_env "$app"
+ mkdir -p "$DOCKER_COMPOSE_DIR/secrets"
+ install -o 100 -g cloud-compose -m 0440 \
+ "$APP_CREDENTIALS_FILE" \
+ "$DOCKER_COMPOSE_DIR/secrets/GOOGLE_APPLICATION_CREDENTIALS"
+done < <(compose_app_names)
popd
diff --git a/rootfs/home/cloud-compose/run.sh b/rootfs/home/cloud-compose/run.sh
index dbb9c99..af1450e 100644
--- a/rootfs/home/cloud-compose/run.sh
+++ b/rootfs/home/cloud-compose/run.sh
@@ -6,13 +6,34 @@ set -x
# shellcheck disable=SC1091
source /home/cloud-compose/profile.sh
+run_as_cloud_compose() {
+ if command -v runuser >/dev/null 2>&1; then
+ runuser -u cloud-compose -- env HOME=/home/cloud-compose PATH="$PATH" "$@"
+ elif command -v sudo >/dev/null 2>&1; then
+ sudo -u cloud-compose env HOME=/home/cloud-compose PATH="$PATH" "$@"
+ elif command -v su >/dev/null 2>&1; then
+ su -s /bin/bash -c "HOME=/home/cloud-compose PATH=$(printf '%q' "$PATH") $(printf '%q ' "$@")" cloud-compose
+ else
+ echo "No supported user-switching command found for cloud-compose app init" >&2
+ return 1
+ fi
+}
+
bash /home/cloud-compose/host-conf.sh
bash /home/cloud-compose/host-init.sh
-bash /home/cloud-compose/app-init.sh
-bash /home/cloud-compose/rotate-keys-app.sh || true
-bash /home/cloud-compose/rotate-keys-internal.sh || true
+run_as_cloud_compose bash /home/cloud-compose/app-init.sh
+if [ "${CLOUD_COMPOSE_PROVIDER:-}" = "gcp" ]; then
+ bash /home/cloud-compose/rotate-keys-app.sh || true
+ bash /home/cloud-compose/rotate-keys-internal.sh || true
+fi
+bash /home/cloud-compose/vault-agent-init.sh || true
systemctl start cloud-compose
-systemctl start internal-services.timer
+if [ "${LIBOPS_INTERNAL_SERVICES_ENABLED:-true}" = "true" ]; then
+ systemctl start internal-services.timer
+fi
systemctl start libops-managed-runtime.timer
systemctl start cron.timer
+systemctl start cloud-compose-mariadb-backup.timer
+touch /home/cloud-compose/.cloud-compose-bootstrap-complete
+chown cloud-compose:cloud-compose /home/cloud-compose/.cloud-compose-bootstrap-complete
diff --git a/rootfs/home/cloud-compose/vault-agent-init.sh b/rootfs/home/cloud-compose/vault-agent-init.sh
new file mode 100644
index 0000000..1377566
--- /dev/null
+++ b/rootfs/home/cloud-compose/vault-agent-init.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# shellcheck disable=SC1091
+source /home/cloud-compose/profile.sh
+
+if [ "${VAULT_AGENT_ENABLED:-false}" != "true" ]; then
+ echo "Vault Agent is disabled"
+ exit 0
+fi
+
+if [ ! -f /etc/vault-agent.d/cloud-compose.hcl ]; then
+ echo "Vault Agent config is missing"
+ exit 0
+fi
+
+if ! command -v vault >/dev/null 2>&1; then
+ echo "Vault binary is not installed; skipping vault-agent.service"
+ exit 0
+fi
+
+mkdir -p "$(dirname "${VAULT_AGENT_TOKEN_PATH:-/mnt/disks/data/vault/token}")"
+chmod 0700 "$(dirname "${VAULT_AGENT_TOKEN_PATH:-/mnt/disks/data/vault/token}")"
+
+systemctl daemon-reload
+systemctl enable vault-agent.service
+systemctl restart vault-agent.service
diff --git a/rootfs/mnt/disks/data/libops-internal/docker-compose.yaml b/rootfs/mnt/disks/data/libops-internal/docker-compose.yaml
index 2c190ad..fb2f802 100644
--- a/rootfs/mnt/disks/data/libops-internal/docker-compose.yaml
+++ b/rootfs/mnt/disks/data/libops-internal/docker-compose.yaml
@@ -2,6 +2,8 @@ networks:
internal:
services:
lightsout:
+ profiles:
+ - lightsout
image: ${LIBOPS_LIGHTSOUT_IMAGE:-ghcr.io/libops/lightsout:main}
ports:
- "8808:8808"
diff --git a/templates/cloud-init.yml b/templates/cloud-init.yml
index 226cc07..ea8d173 100644
--- a/templates/cloud-init.yml
+++ b/templates/cloud-init.yml
@@ -1,8 +1,21 @@
#cloud-config
+groups:
+- docker
+
users:
- name: cloud-compose
shell: /bin/bash
+ groups:
+ - docker
+ sudo:
+ - ALL=(ALL) NOPASSWD:ALL
+%{ if length(CLOUD_COMPOSE_SSH_KEYS) > 0 ~}
+ ssh_authorized_keys:
+%{ for key in CLOUD_COMPOSE_SSH_KEYS ~}
+ - ${key}
+%{ endfor ~}
+%{ endif ~}
%{ for username, ssh_keys in SSH_USERS ~}
- name: ${username}
shell: /bin/bash
@@ -14,15 +27,15 @@ users:
bootcmd:
# mount the main Data disk
-- fsck.ext4 -tvy $(readlink -f /dev/disk/by-id/google-data) || mkfs.ext4 -m 0 -E lazy_itable_init=0,lazy_journal_init=0,discard $(readlink -f /dev/disk/by-id/google-data)
+- fsck.ext4 -tvy $(readlink -f /dev/disk/by-id/google-data) || mkfs.ext4 -m 0 -E lazy_itable_init=1,lazy_journal_init=1,nodiscard $(readlink -f /dev/disk/by-id/google-data)
- mkdir -p /mnt/disks/data
-- mount -o discard,defaults $(readlink -f /dev/disk/by-id/google-data) /mnt/disks/data
+- mount -o defaults $(readlink -f /dev/disk/by-id/google-data) /mnt/disks/data
- chmod a+w /mnt/disks/data
# mount the specific Volumes disk
-- fsck.ext4 -tvy $(readlink -f /dev/disk/by-id/google-docker-volumes) || mkfs.ext4 -m 0 -E lazy_itable_init=0,lazy_journal_init=0,discard $(readlink -f /dev/disk/by-id/google-docker-volumes)
+- fsck.ext4 -tvy $(readlink -f /dev/disk/by-id/google-docker-volumes) || mkfs.ext4 -m 0 -E lazy_itable_init=1,lazy_journal_init=1,nodiscard $(readlink -f /dev/disk/by-id/google-docker-volumes)
- mkdir -p /mnt/disks/volumes
-- mount -o discard,defaults $(readlink -f /dev/disk/by-id/google-docker-volumes) /mnt/disks/volumes
+- mount -o defaults $(readlink -f /dev/disk/by-id/google-docker-volumes) /mnt/disks/volumes
- chmod a+w /mnt/disks/volumes
- mkdir -p /mnt/disks/data/docker/volumes
@@ -36,13 +49,18 @@ bootcmd:
write_files:
${WRITE_FILES_CONTENT}
${DOCKER_COMPOSE_SCRIPTS}
+${COMPOSE_PROJECTS_FILE}
${ENV_FILE_CONTENT}
+${VAULT_AGENT_FILES}
${MANAGED_RUNTIME_ARTIFACTS_FILE}
runcmd:
%{ for CMD in ADDITIONAL_INITCMD ~}
- ${CMD}
%{ endfor ~}
+- chown cloud-compose:cloud-compose /mnt/disks/data /mnt/disks/volumes
+- chmod 0775 /mnt/disks/data /mnt/disks/volumes
+- install -d -m 0775 -o cloud-compose -g cloud-compose /mnt/disks/data/libops
- bash /home/cloud-compose/run.sh > /home/cloud-compose/run.log 2>&1
%{ for VOLUME in DOCKER_VOLUME_OVERLAYS ~}
- bash /home/cloud-compose/overlay-init.sh "${VOLUME}" >> /home/cloud-compose/run.log 2>&1
diff --git a/tests/smoke/digitalocean-isle/.terraform.lock.hcl b/tests/smoke/digitalocean-isle/.terraform.lock.hcl
new file mode 100644
index 0000000..2e1681e
--- /dev/null
+++ b/tests/smoke/digitalocean-isle/.terraform.lock.hcl
@@ -0,0 +1,47 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/digitalocean/digitalocean" {
+ version = "2.93.0"
+ constraints = "~> 2.0"
+ hashes = [
+ "h1:furxWCm/4BbtUX/XHa3TsP0eI+YjQekvcUTyx4BLqnM=",
+ "zh:2509716282fb0d04027279b2d6ffb449d5f4b4a5f380a2ad7b7b6221d2f2fdc4",
+ "zh:3a6407123d127b6948040583c29371b6ea92120d2a239d8bcd27673725673013",
+ "zh:71443c90f85572fce0c563e3587d956afb8be9f0a0090f1c40b33b1005718824",
+ "zh:790c8a3694baba6e28b13d45d86523995ffda4693e0c8ad1584e34deee914fe2",
+ "zh:7fe00fd5d4d322923550651b6ebca9dea14b3b7a68c09ba4c20f9b416a34cb40",
+ "zh:8bf4d5ccb634bacba929fc632d554eddb349b890d26e5f4dbcb53481ca34dbff",
+ "zh:8f545ec1622fa4d42a7112de8cbd0c42f8967e8dafd5c514d77b7ec25914951d",
+ "zh:98300c632e9eabdcecb9f77586a4a48e19dab62b7365410f4ab857ab4007e159",
+ "zh:9db648994459fe62a9e91f9d875dd9220db5b063a00f4eec22dbdf2247a67730",
+ "zh:9f21713916718613da2a42c8b39c503e46399b2d06c3b492979bde939d05d2bb",
+ "zh:a4b4afa0ef6f672d50ac072cae1a39ec6d97716e4ed118900b5db1a553a3c1cd",
+ "zh:bebed73ab49be830ef03346cb91e1da83fff06b555695f69fc3de13c51a456ec",
+ "zh:d207d54f3ab86a0f71c194b8b34a49a219f97dd40ec6db0ed13ed70df9f26aab",
+ "zh:ee4caa17a2e62bfa9c2669ddd909026a3ded3294c4f2bb325cf563f5766e1981",
+ "zh:efb59a5436f103a4930a7cab2e77ba75d31fd08f2f024c9a4177c70a89cd3264",
+ "zh:ffaf97ab916b12c2181bdf5f7232aaac88cce59bb8edbad07a527207da232f90",
+ ]
+}
+
+provider "registry.terraform.io/hashicorp/random" {
+ version = "3.9.0"
+ constraints = "~> 3.7"
+ hashes = [
+ "h1:UlBuNVuCGJ39tTv2c5gz2NRZnQbXfbIWbTzWcth5o74=",
+ "zh:161ad0bd9a75768c82f53fb6e7172a9d8be2d4889b012645a34795031aaf1bf1",
+ "zh:19dc9a5b17729725ccfc4f45b0500af0ee5bc6b6b160c7adb8f2bf617d2c80ea",
+ "zh:269eda8fe42daa7974d5a34d166c3ba9defe80cde86c01e4dadcfdf2e1f05e5f",
+ "zh:373f7c65566f8f2cc7f45d698654feb9d988996957e1266a69ca00c52d6d16d0",
+ "zh:5599d16804c41c83009ec621b6d6b6f74e102f5827678a4750f8809055546b61",
+ "zh:583be0440469a22bff70dcfa56593b01566860b29607437264adb51060cf46fc",
+ "zh:5f211d8ec3f2e1f414870d9584bfe26e6995560ef81c748f8447a48164767398",
+ "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+ "zh:7b547fd16216761ef86efc3ed516ac5ac0c5c42b7c7eb24a08cef2d93f69ed5e",
+ "zh:7e7c0679daf2a382151d05068c8c3f0dae6b7b7dccf818827b73dd08638df2ef",
+ "zh:8089dec888a8038b9b4fb23b3df7e1057293dbc5b60b42cc47ff690d69d4b61b",
+ "zh:c51f15a031edfd6f23ce8ced3446ca7f8d8d647e2499890d7d5d10d5016d7257",
+ "zh:c94784f005708890dc6895afd53636ec00ec1e430b15d41e5aebfb1d4b39bd04",
+ ]
+}
diff --git a/tests/smoke/digitalocean-isle/main.tf b/tests/smoke/digitalocean-isle/main.tf
new file mode 100644
index 0000000..e04d5b1
--- /dev/null
+++ b/tests/smoke/digitalocean-isle/main.tf
@@ -0,0 +1,88 @@
+terraform {
+ required_version = ">= 1.2.4"
+
+ required_providers {
+ digitalocean = {
+ source = "digitalocean/digitalocean"
+ version = "~> 2.0"
+ }
+ random = {
+ source = "hashicorp/random"
+ version = "~> 3.7"
+ }
+ }
+}
+
+provider "digitalocean" {}
+
+resource "random_id" "suffix" {
+ byte_length = 3
+}
+
+locals {
+ smoke_run_id = substr(replace(lower(var.smoke_run_id), "/[^a-z0-9-]/", "-"), 0, 16)
+ name = substr(join("-", compact([var.name_prefix, local.smoke_run_id, random_id.suffix.hex])), 0, 46)
+ tags = distinct(concat(var.tags, ["cloud-compose-smoke", "digitalocean-isle"], local.smoke_run_id != "" ? ["gha-run-${local.smoke_run_id}"] : []))
+}
+
+module "isle" {
+ source = "../../../modules/digitalocean"
+
+ name = local.name
+ digitalocean = {
+ region = var.region
+ tags = local.tags
+ droplet = {
+ size = var.size
+ image = var.image
+ monitoring = true
+ ipv6 = true
+ backups = false
+ }
+ ssh = {
+ cloud_compose_keys = distinct(concat([var.ssh_public_key], var.operator_ssh_public_keys))
+ }
+ volumes = {
+ data_size_gb = var.data_volume_size_gb
+ docker_volumes_size_gb = var.docker_volumes_volume_size_gb
+ }
+ }
+ runtime = {
+ compose = {
+ repo = var.docker_compose_repo
+ branch = var.docker_compose_branch
+ ingress_port = var.ingress_port
+ up = [
+ "sitectl compose --context \"$${SITECTL_CONTEXT_NAME}\" up -d --remove-orphans",
+ "sitectl healthcheck --context \"$${SITECTL_CONTEXT_NAME}\" --persist --timeout \"$${SITECTL_HEALTHCHECK_TIMEOUT}\" --interval \"$${SITECTL_HEALTHCHECK_INTERVAL}\""
+ ]
+ }
+ sitectl = {
+ packages = ["sitectl", "sitectl-drupal", "sitectl-isle"]
+ plugin = "isle"
+ environment = "smoke"
+ healthcheck_timeout = var.healthcheck_timeout
+ healthcheck_interval = var.healthcheck_interval
+ }
+ }
+}
+
+output "smoke" {
+ description = "Remote sitectl context details for the smoke test runner."
+ value = {
+ provider = "digitalocean"
+ app = "isle"
+ host = module.isle.instance.ipv4
+ ssh_user = "cloud-compose"
+ ssh_port = 22
+ context_name = module.isle.primary_compose_project.sitectl_context_name
+ plugin = module.isle.primary_compose_project.sitectl_plugin
+ environment = module.isle.primary_compose_project.sitectl_environment
+ site = local.name
+ project_name = local.name
+ project_dir = module.isle.primary_compose_project.project_dir
+ compose_project_name = module.isle.primary_compose_project.compose_project_name
+ healthcheck_timeout = var.healthcheck_timeout
+ healthcheck_interval = var.healthcheck_interval
+ }
+}
diff --git a/tests/smoke/digitalocean-isle/variables.tf b/tests/smoke/digitalocean-isle/variables.tf
new file mode 100644
index 0000000..0093e66
--- /dev/null
+++ b/tests/smoke/digitalocean-isle/variables.tf
@@ -0,0 +1,100 @@
+variable "name_prefix" {
+ type = string
+ default = "cc-do-isle"
+ description = "Prefix for disposable smoke-test resources."
+
+ validation {
+ condition = can(regex("^[a-z][a-z0-9-]{0,35}$", var.name_prefix))
+ error_message = "name_prefix must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens."
+ }
+}
+
+variable "region" {
+ type = string
+ default = "tor1"
+ description = "DigitalOcean region slug."
+}
+
+variable "size" {
+ type = string
+ default = "s-4vcpu-8gb"
+ description = "DigitalOcean Droplet size slug."
+}
+
+variable "image" {
+ type = string
+ default = "ubuntu-24-04-x64"
+ description = "DigitalOcean Droplet image slug."
+}
+
+variable "ssh_public_key" {
+ type = string
+ description = "Public SSH key authorized for the cloud-compose user."
+
+ validation {
+ condition = trimspace(var.ssh_public_key) != ""
+ error_message = "ssh_public_key is required."
+ }
+}
+
+variable "operator_ssh_public_keys" {
+ type = list(string)
+ default = [
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOuUgUvvcJyWVZkgLrBGGI9RfcNmQsw32QNftNS5/Iiv jcorall@MacBookPro"
+ ]
+ description = "Additional SSH public keys authorized for the cloud-compose user during smoke tests."
+}
+
+variable "smoke_run_id" {
+ type = string
+ default = ""
+ description = "Optional GitHub Actions run id used to tag and name disposable smoke-test resources."
+}
+
+variable "docker_compose_repo" {
+ type = string
+ default = "https://github.com/libops/isle"
+ description = "ISLE compose template repository."
+}
+
+variable "docker_compose_branch" {
+ type = string
+ default = "main"
+ description = "ISLE compose template branch."
+}
+
+variable "ingress_port" {
+ type = number
+ default = 80
+ description = "Host port exposed by Traefik."
+}
+
+variable "data_volume_size_gb" {
+ type = number
+ default = 10
+ description = "Disposable smoke-test data volume size."
+}
+
+variable "docker_volumes_volume_size_gb" {
+ type = number
+ default = 30
+ description = "Disposable smoke-test Docker volumes volume size."
+}
+
+variable "healthcheck_timeout" {
+ type = string
+ default = "30m"
+ description = "Timeout passed to sitectl healthcheck on the VM and from the runner."
+}
+
+variable "healthcheck_interval" {
+ type = string
+ default = "20s"
+ description = "Interval passed to sitectl healthcheck on the VM and from the runner."
+}
+
+variable "tags" {
+ type = list(string)
+ default = ["cloud-compose"]
+ description = "Extra DigitalOcean tags applied to smoke-test resources."
+}
diff --git a/tests/smoke/gcp-wp/main.tf b/tests/smoke/gcp-wp/main.tf
new file mode 100644
index 0000000..b563a87
--- /dev/null
+++ b/tests/smoke/gcp-wp/main.tf
@@ -0,0 +1,114 @@
+terraform {
+ required_version = ">= 1.2.4"
+
+ required_providers {
+ google = {
+ source = "hashicorp/google"
+ version = "~> 7.0"
+ }
+ random = {
+ source = "hashicorp/random"
+ version = "~> 3.7"
+ }
+ }
+}
+
+provider "google" {
+ project = local.project_id
+ region = var.gcp_region
+ zone = var.gcp_zone
+}
+
+data "google_project" "current" {
+ project_id = local.project_id
+}
+
+resource "random_id" "suffix" {
+ byte_length = 2
+}
+
+locals {
+ project_id = trimspace(var.gcp_project_id)
+ smoke_run_id = substr(replace(lower(var.smoke_run_id), "/[^a-z0-9-]/", "-"), 0, 8)
+ name = substr(join("-", compact([var.name_prefix, local.smoke_run_id, random_id.suffix.hex])), 0, 21)
+}
+
+module "wp" {
+ source = "../../.."
+
+ name = local.name
+ gcp = {
+ project_id = local.project_id
+ project_number = data.google_project.current.number
+ region = var.gcp_region
+ zone = var.gcp_zone
+ instance = {
+ machine_type = var.machine_type
+ os = var.os
+ production = false
+ }
+ disks = {
+ type = var.disk_type
+ docker_volumes_size_gb = var.docker_volumes_volume_size_gb
+ }
+ snapshots = {
+ enabled = false
+ }
+ network = {
+ ssh_ipv4 = var.ssh_source_ranges
+ ssh_ipv6 = []
+ }
+ power_management = {
+ enabled = false
+ }
+ }
+ runtime = {
+ users = {
+ cloud-compose = distinct(concat([var.ssh_public_key], var.operator_ssh_public_keys))
+ }
+ compose = {
+ repo = var.docker_compose_repo
+ branch = var.docker_compose_branch
+ ingress_port = var.ingress_port
+ up = [
+ "sitectl compose --context \"$${SITECTL_CONTEXT_NAME}\" up -d --remove-orphans",
+ "sitectl healthcheck --context \"$${SITECTL_CONTEXT_NAME}\" --persist --timeout \"$${SITECTL_HEALTHCHECK_TIMEOUT}\" --interval \"$${SITECTL_HEALTHCHECK_INTERVAL}\""
+ ]
+ }
+ sitectl = {
+ packages = ["sitectl", "sitectl-wp"]
+ plugin = "wp"
+ environment = "smoke"
+ healthcheck_timeout = var.healthcheck_timeout
+ healthcheck_interval = var.healthcheck_interval
+ }
+ managed_runtime = {
+ enabled = true
+ internal_services_enabled = false
+ internal_services_auto_update = false
+ }
+ vault = {
+ auth_method = "consumer-managed"
+ }
+ }
+}
+
+output "smoke" {
+ description = "Remote sitectl context details for the smoke test runner."
+ value = {
+ provider = "gcp"
+ app = "wp"
+ host = module.wp.external_ip
+ ssh_user = "cloud-compose"
+ ssh_port = 22
+ context_name = module.wp.primary_compose_project.sitectl_context_name
+ plugin = module.wp.primary_compose_project.sitectl_plugin
+ environment = module.wp.primary_compose_project.sitectl_environment
+ site = local.name
+ project_name = local.name
+ project_dir = module.wp.primary_compose_project.project_dir
+ compose_project_name = module.wp.primary_compose_project.compose_project_name
+ healthcheck_timeout = var.healthcheck_timeout
+ healthcheck_interval = var.healthcheck_interval
+ }
+}
diff --git a/tests/smoke/gcp-wp/variables.tf b/tests/smoke/gcp-wp/variables.tf
new file mode 100644
index 0000000..d6fe985
--- /dev/null
+++ b/tests/smoke/gcp-wp/variables.tf
@@ -0,0 +1,116 @@
+variable "name_prefix" {
+ type = string
+ default = "cc-gwp"
+ description = "Prefix for disposable smoke-test resources."
+
+ validation {
+ condition = can(regex("^[a-z][a-z0-9-]{0,8}$", var.name_prefix))
+ error_message = "name_prefix must start with a lowercase letter, contain only lowercase letters, numbers, and hyphens, and leave room for service account prefixes."
+ }
+}
+
+variable "gcp_project_id" {
+ type = string
+ description = "Google Cloud project used for disposable smoke-test resources."
+
+ validation {
+ condition = trimspace(var.gcp_project_id) != ""
+ error_message = "gcp_project_id is required."
+ }
+}
+
+variable "gcp_region" {
+ type = string
+ default = "us-east5"
+ description = "Google Cloud region for smoke-test resources."
+}
+
+variable "gcp_zone" {
+ type = string
+ default = "us-east5-b"
+ description = "Google Cloud zone for smoke-test resources."
+}
+
+variable "machine_type" {
+ type = string
+ default = "e2-medium"
+ description = "Google Compute Engine machine type."
+}
+
+variable "disk_type" {
+ type = string
+ default = "pd-standard"
+ description = "Google Compute Engine disk type."
+}
+
+variable "os" {
+ type = string
+ default = "cos-125-19216-220-185"
+ description = "Compute-optimized OS image name."
+}
+
+variable "ssh_public_key" {
+ type = string
+ description = "Public SSH key authorized for the cloud-compose user."
+
+ validation {
+ condition = trimspace(var.ssh_public_key) != ""
+ error_message = "ssh_public_key is required."
+ }
+}
+
+variable "operator_ssh_public_keys" {
+ type = list(string)
+ default = [
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOuUgUvvcJyWVZkgLrBGGI9RfcNmQsw32QNftNS5/Iiv jcorall@MacBookPro"
+ ]
+ description = "Additional SSH public keys authorized for operator access during smoke tests."
+}
+
+variable "ssh_source_ranges" {
+ type = list(string)
+ default = ["0.0.0.0/0"]
+ description = "CIDR IPv4 ranges allowed to SSH into the disposable smoke-test VM."
+}
+
+variable "smoke_run_id" {
+ type = string
+ default = ""
+ description = "Optional GitHub Actions run id used to tag and name disposable smoke-test resources."
+}
+
+variable "docker_compose_repo" {
+ type = string
+ default = "https://github.com/libops/wp.git"
+ description = "WordPress compose template repository."
+}
+
+variable "docker_compose_branch" {
+ type = string
+ default = "main"
+ description = "WordPress compose template branch."
+}
+
+variable "ingress_port" {
+ type = number
+ default = 80
+ description = "Host port exposed by Traefik."
+}
+
+variable "docker_volumes_volume_size_gb" {
+ type = number
+ default = 50
+ description = "Persistent Docker volumes disk size."
+}
+
+variable "healthcheck_timeout" {
+ type = string
+ default = "20m"
+ description = "Timeout passed to sitectl healthcheck on the VM and from the runner."
+}
+
+variable "healthcheck_interval" {
+ type = string
+ default = "20s"
+ description = "Interval passed to sitectl healthcheck on the VM and from the runner."
+}
diff --git a/tests/smoke/linode-wp/.terraform.lock.hcl b/tests/smoke/linode-wp/.terraform.lock.hcl
new file mode 100644
index 0000000..d835c18
--- /dev/null
+++ b/tests/smoke/linode-wp/.terraform.lock.hcl
@@ -0,0 +1,44 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/random" {
+ version = "3.9.0"
+ constraints = "~> 3.7"
+ hashes = [
+ "h1:UlBuNVuCGJ39tTv2c5gz2NRZnQbXfbIWbTzWcth5o74=",
+ "zh:161ad0bd9a75768c82f53fb6e7172a9d8be2d4889b012645a34795031aaf1bf1",
+ "zh:19dc9a5b17729725ccfc4f45b0500af0ee5bc6b6b160c7adb8f2bf617d2c80ea",
+ "zh:269eda8fe42daa7974d5a34d166c3ba9defe80cde86c01e4dadcfdf2e1f05e5f",
+ "zh:373f7c65566f8f2cc7f45d698654feb9d988996957e1266a69ca00c52d6d16d0",
+ "zh:5599d16804c41c83009ec621b6d6b6f74e102f5827678a4750f8809055546b61",
+ "zh:583be0440469a22bff70dcfa56593b01566860b29607437264adb51060cf46fc",
+ "zh:5f211d8ec3f2e1f414870d9584bfe26e6995560ef81c748f8447a48164767398",
+ "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+ "zh:7b547fd16216761ef86efc3ed516ac5ac0c5c42b7c7eb24a08cef2d93f69ed5e",
+ "zh:7e7c0679daf2a382151d05068c8c3f0dae6b7b7dccf818827b73dd08638df2ef",
+ "zh:8089dec888a8038b9b4fb23b3df7e1057293dbc5b60b42cc47ff690d69d4b61b",
+ "zh:c51f15a031edfd6f23ce8ced3446ca7f8d8d647e2499890d7d5d10d5016d7257",
+ "zh:c94784f005708890dc6895afd53636ec00ec1e430b15d41e5aebfb1d4b39bd04",
+ ]
+}
+
+provider "registry.terraform.io/linode/linode" {
+ version = "4.0.0"
+ constraints = "~> 4.0"
+ hashes = [
+ "h1:ZUykBGGXIJsXzafpxxKN+oRJh/n/d+jFiiTZlYVDrvY=",
+ "zh:01e0045344d13ca61c8b065df73b007bf45f665eb419d045a31c8d9ba48ede86",
+ "zh:3e22a4672940ec1a8c59bd6c8d594a6fb4bdfc50efa993ac2b9edd21a9459b03",
+ "zh:467c82a79a04cc2f279b4b8206db691035dbcb3ba88f8a29a63e060046a7747b",
+ "zh:4d7f3a1ec9dfa15ea2bac0f9670885812d09e45737d55c7daea049770143bc1d",
+ "zh:4d9b946d66940231488990943f9564725891310f8500c149af380eba614f5ab4",
+ "zh:75b48ac11262ac401c2fc3eb5fb73b01ad1607a1c2a0ddcb42687d1941158e6d",
+ "zh:864de67a080eeb4b14902056dc96bd29f1dc935442440cdb774ad2d46a872ca9",
+ "zh:a3fd99fb4f9b2e631c63b0ab9ff4d28e32aca4ff0a14b9271fdc634798ecc808",
+ "zh:b0c63ea32e65a76e987a086dc4ee6d8f445876a59d7a5a94aa2f225f5fd8729f",
+ "zh:b3d6f4461724983798af50bc91003b0e7892a5b2ab172d7fd0a8d57578c6a7bf",
+ "zh:b5f2643c36657241b6ef4a987727e99352ed2dcf63d54cba6d5292ee0edd59f4",
+ "zh:bf148ad0a4cdd049de12bdea2dc2bb20f2a0e09574a1917f7e45c1f54aa8dc0b",
+ "zh:d1448b79e1c9c9d14adc03c97730f68fec042011012ec6727ff7b17d7e130df4",
+ ]
+}
diff --git a/tests/smoke/linode-wp/main.tf b/tests/smoke/linode-wp/main.tf
new file mode 100644
index 0000000..a843967
--- /dev/null
+++ b/tests/smoke/linode-wp/main.tf
@@ -0,0 +1,87 @@
+terraform {
+ required_version = ">= 1.2.4"
+
+ required_providers {
+ linode = {
+ source = "linode/linode"
+ version = "~> 4.0"
+ }
+ random = {
+ source = "hashicorp/random"
+ version = "~> 3.7"
+ }
+ }
+}
+
+provider "linode" {}
+
+resource "random_id" "suffix" {
+ byte_length = 3
+}
+
+locals {
+ smoke_run_id = substr(replace(lower(var.smoke_run_id), "/[^a-z0-9-]/", "-"), 0, 16)
+ name = substr(join("-", compact([var.name_prefix, local.smoke_run_id, random_id.suffix.hex])), 0, 46)
+ tags = distinct(concat(var.tags, ["cloud-compose-smoke", "linode-wp"], local.smoke_run_id != "" ? ["gha-run-${local.smoke_run_id}"] : []))
+}
+
+module "wp" {
+ source = "../../../modules/linode"
+
+ name = local.name
+ linode = {
+ region = var.region
+ tags = local.tags
+ instance = {
+ type = var.type
+ image = var.image
+ authorized_keys = distinct(concat([var.ssh_public_key], var.operator_ssh_public_keys))
+ }
+ ssh = {
+ cloud_compose_keys = distinct(concat([var.ssh_public_key], var.operator_ssh_public_keys))
+ }
+ volumes = {
+ data_size_gb = var.data_volume_size_gb
+ docker_volumes_size_gb = var.docker_volumes_volume_size_gb
+ }
+ }
+ runtime = {
+ rootfs_archive_url = "https://github.com/libops/cloud-compose/archive/${var.cloud_compose_source_ref}.tar.gz"
+ compose = {
+ repo = var.docker_compose_repo
+ branch = var.docker_compose_branch
+ ingress_port = var.ingress_port
+ up = [
+ "sitectl compose --context \"$${SITECTL_CONTEXT_NAME}\" up -d --remove-orphans",
+ "sitectl healthcheck --context \"$${SITECTL_CONTEXT_NAME}\" --persist --timeout \"$${SITECTL_HEALTHCHECK_TIMEOUT}\" --interval \"$${SITECTL_HEALTHCHECK_INTERVAL}\""
+ ]
+ }
+ sitectl = {
+ packages = ["sitectl", "sitectl-wp"]
+ plugin = "wp"
+ environment = "smoke"
+ healthcheck_timeout = var.healthcheck_timeout
+ healthcheck_interval = var.healthcheck_interval
+ }
+ }
+}
+
+output "smoke" {
+ description = "Remote sitectl context details for the smoke test runner."
+ value = {
+ provider = "linode"
+ app = "wp"
+ host = module.wp.instance.public_ipv4
+ ssh_user = "cloud-compose"
+ ssh_port = 22
+ context_name = module.wp.primary_compose_project.sitectl_context_name
+ plugin = module.wp.primary_compose_project.sitectl_plugin
+ environment = module.wp.primary_compose_project.sitectl_environment
+ site = local.name
+ project_name = local.name
+ project_dir = module.wp.primary_compose_project.project_dir
+ compose_project_name = module.wp.primary_compose_project.compose_project_name
+ healthcheck_timeout = var.healthcheck_timeout
+ healthcheck_interval = var.healthcheck_interval
+ }
+}
diff --git a/tests/smoke/linode-wp/variables.tf b/tests/smoke/linode-wp/variables.tf
new file mode 100644
index 0000000..bc529b5
--- /dev/null
+++ b/tests/smoke/linode-wp/variables.tf
@@ -0,0 +1,106 @@
+variable "name_prefix" {
+ type = string
+ default = "cc-linode-wp"
+ description = "Prefix for disposable smoke-test resources."
+
+ validation {
+ condition = can(regex("^[a-z][a-z0-9-]{0,35}$", var.name_prefix))
+ error_message = "name_prefix must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens."
+ }
+}
+
+variable "region" {
+ type = string
+ default = "us-east"
+ description = "Linode region slug."
+}
+
+variable "type" {
+ type = string
+ default = "g6-standard-2"
+ description = "Linode instance type."
+}
+
+variable "image" {
+ type = string
+ default = "linode/ubuntu22.04"
+ description = "Linode image slug."
+}
+
+variable "ssh_public_key" {
+ type = string
+ description = "Public SSH key authorized for the root and cloud-compose users."
+
+ validation {
+ condition = trimspace(var.ssh_public_key) != ""
+ error_message = "ssh_public_key is required."
+ }
+}
+
+variable "operator_ssh_public_keys" {
+ type = list(string)
+ default = [
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOuUgUvvcJyWVZkgLrBGGI9RfcNmQsw32QNftNS5/Iiv jcorall@MacBookPro"
+ ]
+ description = "Additional SSH public keys authorized for operator access during smoke tests."
+}
+
+variable "smoke_run_id" {
+ type = string
+ default = ""
+ description = "Optional GitHub Actions run id used to tag and name disposable smoke-test resources."
+}
+
+variable "docker_compose_repo" {
+ type = string
+ default = "https://github.com/libops/wp.git"
+ description = "WordPress compose template repository."
+}
+
+variable "docker_compose_branch" {
+ type = string
+ default = "main"
+ description = "WordPress compose template branch."
+}
+
+variable "ingress_port" {
+ type = number
+ default = 80
+ description = "Host port exposed by Traefik."
+}
+
+variable "data_volume_size_gb" {
+ type = number
+ default = 10
+ description = "Disposable smoke-test data volume size."
+}
+
+variable "docker_volumes_volume_size_gb" {
+ type = number
+ default = 20
+ description = "Disposable smoke-test Docker volumes volume size."
+}
+
+variable "healthcheck_timeout" {
+ type = string
+ default = "20m"
+ description = "Timeout passed to sitectl healthcheck on the VM and from the runner."
+}
+
+variable "healthcheck_interval" {
+ type = string
+ default = "20s"
+ description = "Interval passed to sitectl healthcheck on the VM and from the runner."
+}
+
+variable "tags" {
+ type = list(string)
+ default = ["cloud-compose"]
+ description = "Extra Linode tags applied to smoke-test resources."
+}
+
+variable "cloud_compose_source_ref" {
+ type = string
+ default = "main"
+ description = "cloud-compose Git ref whose rootfs is fetched by Linode cloud-init."
+}
diff --git a/variables.tf b/variables.tf
index b1557ed..8dc8adc 100644
--- a/variables.tf
+++ b/variables.tf
@@ -1,54 +1,91 @@
-variable "project_id" {
- description = "The GCP project ID"
- type = string
-}
-
-variable "project_number" {
- type = string
- description = "The GCP project number"
-}
-
-variable "region" {
- description = "GCP region for resources"
- type = string
- default = "us-east5"
-}
-
-variable "zone" {
- description = "GCP zone for resources"
- type = string
- default = "us-east5-b"
-}
-
variable "name" {
type = string
- description = "The site name (will be the name of the GCP instance)"
+ description = "Deployment name."
}
-variable "service_account_email" {
- description = "Existing service account email for the VM. When empty, this module creates one."
- type = string
- default = ""
-}
+variable "gcp" {
+ description = "Google Cloud infrastructure settings."
+ type = object({
+ project_id = string
+ project_number = string
+ region = optional(string, "us-east5")
+ zone = optional(string, "us-east5-b")
+
+ identity = optional(object({
+ vm_service_account_email = optional(string, "")
+ app_service_account_email = optional(string, "")
+ }), {})
+
+ instance = optional(object({
+ machine_type = optional(string, "n4-standard-2")
+ os = optional(string, "cos-125-19216-220-185")
+ production = optional(bool, false)
+ }), {})
+
+ disks = optional(object({
+ type = optional(string, "hyperdisk-balanced")
+ docker_volumes_size_gb = optional(number, 50)
+ }), {})
+
+ network = optional(object({
+ create = optional(bool, true)
+ name = optional(string, "")
+ subnetwork = optional(string, "")
+ ip_cidr_range = optional(string, "10.42.0.0/24")
+ power_button_allowed_ips = optional(list(string), [])
+ ssh_ipv4 = optional(list(string), [])
+ ssh_ipv6 = optional(list(string), [])
+ }), {})
+
+ snapshots = optional(object({
+ enabled = optional(bool, false)
+ }), {})
+
+ overlay = optional(object({
+ source_instance = optional(string, "")
+ volume_names = optional(list(string), [])
+ }), {})
+
+ cloud_init = optional(object({
+ initcmd = optional(list(string), [])
+ runcmd = optional(list(string), [])
+ }), {})
+
+ artifact_registry = optional(object({
+ repository = optional(string, "")
+ location = optional(string, "us")
+ }), {})
+
+ power_management = optional(object({
+ enabled = optional(bool, true)
+ frontend = optional(object({
+ image = string
+ port = optional(number, 8080)
+ cpu = optional(string, "1000m")
+ memory = optional(string, "1Gi")
+ }), null)
+ }), {})
+
+ rollout = optional(object({
+ enabled = optional(bool, false)
+ release_url = optional(string, "")
+ release_sha256 = optional(string, "")
+ port = optional(number, 8081)
+ jwks_uri = optional(string, "")
+ jwt_audience = optional(string, "")
+ custom_claims = optional(string, "")
+ allowed_ipv4 = optional(list(string), ["10.0.0.0/8"])
+ }), {})
+ })
-variable "disk_type" {
- type = string
- description = "The disk type for disks attached to the machine"
- default = "hyperdisk-balanced"
validation {
condition = contains([
"hyperdisk-balanced",
"pd-ssd",
"pd-standard",
- ], var.disk_type)
- error_message = "Invalid 'disk_type'"
+ ], var.gcp.disks.type)
+ error_message = "gcp.disks.type must be hyperdisk-balanced, pd-ssd, or pd-standard."
}
-}
-
-variable "machine_type" {
- type = string
- default = "n4-standard-2"
- description = "VM machine type (General-purpose series that support Hyperdisk Balanced"
validation {
condition = contains([
@@ -70,343 +107,176 @@ variable "machine_type" {
"c4-standard-32",
"c4-standard-48",
"c4-standard-96",
- ], var.machine_type)
- error_message = "The 'machine_type' must be from a General-Purpose family that supports Hyperdisk Balanced (C4, or N4 series)"
+ ], var.gcp.instance.machine_type)
+ error_message = "gcp.instance.machine_type must be an allowed general-purpose machine type."
}
-}
-
-variable "ingress_port" {
- type = number
- default = 80
- description = "TCP port on the VM that the Cloud Run ingress should connect to."
-}
-
-variable "disk_size_gb" {
- type = number
- default = 50
- description = "Data disk size in GB"
-}
-
-variable "os" {
- type = string
- default = "cos-125-19216-220-185"
- description = "The host OS to install on the GCP instance"
-}
-
-variable "docker_compose_repo" {
- type = string
- description = "git repo to checkout that contains a docker compose project"
-}
-
-variable "docker_compose_branch" {
- type = string
- default = "main"
- description = "git branch to checkout for var.docker_compose_repo"
-}
-
-variable "docker_compose_init" {
- type = list(string)
- default = [
- "sitectl config set-context \"$${SITECTL_CONTEXT_NAME}\" --type local --project-dir \"$${DOCKER_COMPOSE_DIR}\" --site \"$${GCP_INSTANCE_NAME}\" --plugin \"$${SITECTL_PLUGIN}\" --environment \"$${SITECTL_ENVIRONMENT}\" --project-name \"$${GCP_INSTANCE_NAME}\" --compose-project-name \"$${COMPOSE_PROJECT_NAME}\" --docker-socket /var/run/docker.sock --env-file .env --default"
- ]
- description = "After cloning the docker compose git repo, any initialization that needs to happen before the docker compose project can start. One command per list value"
-}
-variable "docker_compose_up" {
- type = list(string)
- default = [
- "sitectl deploy --context \"$${SITECTL_CONTEXT_NAME}\" --skip-git",
- "sitectl healthcheck --context \"$${SITECTL_CONTEXT_NAME}\" --persist --timeout \"$${SITECTL_HEALTHCHECK_TIMEOUT}\" --interval \"$${SITECTL_HEALTHCHECK_INTERVAL}\"",
- "if [ \"$${SITECTL_ENVIRONMENT}\" != \"production\" ]; then sitectl verify --context \"$${SITECTL_CONTEXT_NAME}\" $${SITECTL_VERIFY_ARGS:-}; fi",
- "sitectl compose --context \"$${SITECTL_CONTEXT_NAME}\" logs -f"
- ]
- description = "Command to start the docker compose project"
-}
-
-variable "docker_compose_down" {
- type = list(string)
- default = [
- "sitectl compose --context \"$${SITECTL_CONTEXT_NAME}\" down"
- ]
- description = "Command to stop the docker compose project"
+ validation {
+ condition = var.gcp.rollout.release_sha256 == "" || can(regex("^[0-9a-f]{64}$", var.gcp.rollout.release_sha256))
+ error_message = "gcp.rollout.release_sha256 must be empty or a lowercase SHA256 hex digest."
+ }
}
-variable "docker_compose_rollout" {
- type = list(string)
- default = [
- "TARGET_REF=\"$${GIT_REF:-$${GIT_BRANCH:-$${DOCKER_COMPOSE_BRANCH:-main}}}\"",
- "if [ -x ./scripts/rollout.sh ]; then ./scripts/rollout.sh; else sitectl deploy --context \"$${SITECTL_CONTEXT_NAME}\" --branch \"$TARGET_REF\"; fi",
- "sitectl healthcheck --context \"$${SITECTL_CONTEXT_NAME}\" --persist --timeout \"$${SITECTL_HEALTHCHECK_TIMEOUT}\" --interval \"$${SITECTL_HEALTHCHECK_INTERVAL}\"",
- "if [ \"$${SITECTL_ENVIRONMENT}\" != \"production\" ]; then sitectl verify --context \"$${SITECTL_CONTEXT_NAME}\" $${SITECTL_VERIFY_ARGS:-}; fi"
- ]
- description = "Command to roll out a new git ref for the docker compose project. The optional rollout service sets GIT_REF/GIT_BRANCH from the trigger request."
-}
+variable "runtime" {
+ description = "Provider-neutral compose/runtime settings."
+ type = object({
+ rootfs = optional(string, "")
+ users = optional(map(list(string)), {})
+
+ compose = optional(object({
+ primary = optional(string, "")
+ ingress_port = optional(number, 80)
+ ingress = optional(object({
+ letsencrypt = optional(bool, false)
+ bot_mitigation = optional(bool, false)
+ mode = optional(string, "")
+ domain = optional(string, "")
+ acme_email = optional(string, "")
+ trusted_ips = optional(list(string), [])
+ max_upload_size = optional(string, "")
+ upload_timeout = optional(string, "")
+ }), {})
+ repo = optional(string, "")
+ branch = optional(string, "main")
+ projects = optional(map(object({
+ docker_compose_repo = string
+ docker_compose_branch = optional(string)
+ project_dir = optional(string)
+ compose_project_name = optional(string)
+ ingress_port = optional(number)
+ ingress = optional(object({
+ letsencrypt = optional(bool)
+ bot_mitigation = optional(bool)
+ mode = optional(string)
+ domain = optional(string)
+ acme_email = optional(string)
+ trusted_ips = optional(list(string))
+ max_upload_size = optional(string)
+ upload_timeout = optional(string)
+ }), {})
+ sitectl_context_name = optional(string)
+ sitectl_plugin = optional(string)
+ sitectl_environment = optional(string)
+ sitectl_packages = optional(list(string), [])
+ sitectl_verify_args = optional(list(string), [])
+ docker_compose_init = optional(list(string))
+ docker_compose_up = optional(list(string))
+ docker_compose_down = optional(list(string))
+ docker_compose_rollout = optional(list(string))
+ })), {})
+ init = optional(list(string), [
+ "sitectl config set-context \"$${SITECTL_CONTEXT_NAME}\" --type local --project-dir \"$${DOCKER_COMPOSE_DIR}\" --site \"$${CLOUD_COMPOSE_INSTANCE_NAME}\" --plugin \"$${SITECTL_PLUGIN}\" --environment \"$${SITECTL_ENVIRONMENT}\" --project-name \"$${CLOUD_COMPOSE_INSTANCE_NAME}\" --compose-project-name \"$${COMPOSE_PROJECT_NAME}\" --docker-socket /var/run/docker.sock --env-file .env --default"
+ ])
+ up = optional(list(string), [
+ "sitectl compose --context \"$${SITECTL_CONTEXT_NAME}\" up -d --remove-orphans",
+ "sitectl healthcheck --context \"$${SITECTL_CONTEXT_NAME}\" --persist --timeout \"$${SITECTL_HEALTHCHECK_TIMEOUT}\" --interval \"$${SITECTL_HEALTHCHECK_INTERVAL}\"",
+ "if [ \"$${SITECTL_ENVIRONMENT}\" != \"production\" ]; then sitectl verify --context \"$${SITECTL_CONTEXT_NAME}\" $${SITECTL_VERIFY_ARGS:-}; fi"
+ ])
+ down = optional(list(string), [
+ "sitectl compose --context \"$${SITECTL_CONTEXT_NAME}\" down"
+ ])
+ rollout = optional(list(string), [
+ "TARGET_REF=\"$${GIT_REF:-$${GIT_BRANCH:-$${DOCKER_COMPOSE_BRANCH:-main}}}\"",
+ "if [ -x ./scripts/rollout.sh ]; then ./scripts/rollout.sh; else sitectl deploy --context \"$${SITECTL_CONTEXT_NAME}\" --branch \"$TARGET_REF\"; fi",
+ "sitectl healthcheck --context \"$${SITECTL_CONTEXT_NAME}\" --persist --timeout \"$${SITECTL_HEALTHCHECK_TIMEOUT}\" --interval \"$${SITECTL_HEALTHCHECK_INTERVAL}\"",
+ "if [ \"$${SITECTL_ENVIRONMENT}\" != \"production\" ]; then sitectl verify --context \"$${SITECTL_CONTEXT_NAME}\" $${SITECTL_VERIFY_ARGS:-}; fi"
+ ])
+ }), {})
+
+ sitectl = optional(object({
+ packages = optional(list(string), ["sitectl"])
+ version = optional(string, "latest")
+ context_name = optional(string, "")
+ plugin = optional(string, "core")
+ environment = optional(string, "production")
+ healthcheck_timeout = optional(string, "10m")
+ healthcheck_interval = optional(string, "15s")
+ verify_args = optional(list(string), [])
+ }), {})
+
+ docker = optional(object({
+ # renovate: datasource=github-releases depName=docker-compose packageName=docker/compose versioning=semver
+ compose_version = optional(string, "v5.2.0")
+ # renovate: datasource=github-releases depName=docker-buildx packageName=docker/buildx versioning=semver
+ buildx_version = optional(string, "v0.35.0")
+ }), {})
+
+ managed_runtime = optional(object({
+ enabled = optional(bool, true)
+ internal_services_enabled = optional(bool, true)
+ internal_services_auto_update = optional(bool, true)
+ lightsout_image = optional(string, "ghcr.io/libops/lightsout:main")
+ cap_image = optional(string, "ghcr.io/libops/cap:main")
+ cadvisor_image = optional(string, "ghcr.io/google/cadvisor:v0.57.0@sha256:e75bdb03b74b0b6995f208f166fead2e6e555dde73e44200113bb26f41b1981d")
+ artifacts = optional(list(object({
+ name = string
+ url = string
+ sha256 = string
+ path = string
+ mode = optional(string, "0755")
+ owner = optional(string, "root")
+ group = optional(string, "root")
+ restart = optional(string, "")
+ })), [])
+ }), {})
+
+ vault = optional(object({
+ addr = optional(string, "")
+ namespace = optional(string, "")
+ role = optional(string, "")
+ agent_enabled = optional(bool, false)
+ auth_method = optional(string, "gcp-iam")
+ gcp_auth_mount_path = optional(string, "auth/gcp")
+ agent_token_path = optional(string, "/mnt/disks/data/vault/token")
+ agent_additional_config = optional(string, "")
+ agent_templates = optional(list(object({
+ destination = string
+ contents = string
+ perms = optional(string, "0640")
+ command = optional(string, "")
+ })), [])
+ }), {})
+ })
+ default = {}
-variable "sitectl_packages" {
- type = list(string)
- default = ["sitectl"]
- description = "LibOps GitHub release package names to install and keep updated on the VM. Include plugin packages such as sitectl-isle or sitectl-wp as needed."
+ validation {
+ condition = alltrue([
+ for name, app in var.runtime.compose.projects :
+ can(regex("^[a-z][a-z0-9-]*$", name)) &&
+ trimspace(app.docker_compose_repo) != "" &&
+ try(app.ingress_port, var.runtime.compose.ingress_port) > 0 &&
+ try(app.ingress_port, var.runtime.compose.ingress_port) <= 65535
+ ])
+ error_message = "runtime.compose.projects keys must match ^[a-z][a-z0-9-]*$, docker_compose_repo is required, and ingress_port must be between 1 and 65535."
+ }
validation {
condition = alltrue([
- for package in var.sitectl_packages :
+ for package in var.runtime.sitectl.packages :
can(regex("^sitectl(-[a-z0-9]+)*$", package))
])
- error_message = "sitectl_packages entries must be release package names such as sitectl, sitectl-isle, or sitectl-wp."
+ error_message = "runtime.sitectl.packages entries must be release package names such as sitectl, sitectl-isle, or sitectl-wp."
}
-}
-
-variable "sitectl_version" {
- type = string
- default = "latest"
- description = "Sitectl release tag to install for sitectl packages, or latest to follow https://github.com/libops/sitectl/releases/latest."
validation {
- condition = var.sitectl_version == "latest" || can(regex("^v?[0-9]+\\.[0-9]+\\.[0-9]+", var.sitectl_version))
- error_message = "sitectl_version must be latest or a release tag such as v0.19.7."
+ condition = var.runtime.sitectl.version == "latest" || can(regex("^v?[0-9]+\\.[0-9]+\\.[0-9]+", var.runtime.sitectl.version))
+ error_message = "runtime.sitectl.version must be latest or a release tag such as v0.19.7."
}
-}
-
-variable "sitectl_context_name" {
- type = string
- default = ""
- description = "Sitectl context name to create on the VM. Defaults to var.name."
-}
-
-variable "sitectl_plugin" {
- type = string
- default = "core"
- description = "Sitectl plugin id to associate with the VM context."
-}
-
-variable "sitectl_environment" {
- type = string
- default = "production"
- description = "Sitectl environment label. Production runs healthcheck only by default; non-production also runs sitectl verify."
-}
-
-variable "production" {
- type = bool
- default = false
- description = "Whether this VM is the production environment. Production VMs reserve one matching machine so stop/start and recreate operations keep capacity."
-}
-
-variable "sitectl_healthcheck_timeout" {
- type = string
- default = "10m"
- description = "Timeout passed to sitectl healthcheck --timeout in default lifecycle commands."
-}
-
-variable "sitectl_healthcheck_interval" {
- type = string
- default = "15s"
- description = "Interval passed to sitectl healthcheck --interval in default lifecycle commands."
-}
-
-variable "sitectl_verify_args" {
- type = list(string)
- default = []
- description = "Additional arguments appended to sitectl verify by the default non-production lifecycle commands."
-}
-
-variable "libops_managed_runtime_enabled" {
- type = bool
- default = true
- description = "Install and periodically update LibOps-managed host tools and internal VM services."
-}
-
-variable "libops_internal_services_auto_update" {
- type = bool
- default = true
- description = "Whether the managed runtime updater should pull and restart the internal LibOps compose project."
-}
-
-variable "libops_lightsout_image" {
- type = string
- default = "ghcr.io/libops/lightsout:main"
- description = "Container image used for the internal lightsout service."
-}
-
-variable "libops_cap_image" {
- type = string
- default = "ghcr.io/libops/cap:main"
- description = "Container image used for the internal CAP metrics service."
-}
-variable "libops_cadvisor_image" {
- type = string
- default = "ghcr.io/google/cadvisor:v0.57.0@sha256:e75bdb03b74b0b6995f208f166fead2e6e555dde73e44200113bb26f41b1981d"
- description = "Container image used for the internal cAdvisor service."
-}
-
-variable "libops_managed_artifacts" {
- type = list(object({
- name = string
- url = string
- sha256 = string
- path = string
- mode = optional(string, "0755")
- owner = optional(string, "root")
- group = optional(string, "root")
- restart = optional(string, "")
- }))
- default = []
- description = "Additional LibOps-managed files or binaries to download, verify, install, and optionally restart with the managed runtime updater."
+ validation {
+ condition = contains(["gcp-iam", "consumer-managed"], var.runtime.vault.auth_method)
+ error_message = "runtime.vault.auth_method must be gcp-iam or consumer-managed."
+ }
validation {
condition = alltrue([
- for artifact in var.libops_managed_artifacts :
+ for artifact in var.runtime.managed_runtime.artifacts :
!can(regex("[\t\r\n]", artifact.name)) &&
!can(regex("[\t\r\n]", artifact.url)) &&
!can(regex("[\t\r\n]", artifact.sha256)) &&
!can(regex("[\t\r\n]", artifact.path)) &&
can(regex("^[0-9a-f]{64}$", artifact.sha256))
])
- error_message = "libops_managed_artifacts values must not contain tabs or newlines, and sha256 must be a lowercase SHA256 hex digest."
+ error_message = "runtime.managed_runtime.artifacts values must not contain tabs or newlines, and sha256 must be a lowercase SHA256 hex digest."
}
}
-
-variable "allowed_ips" {
- type = list(string)
- default = []
- description = "CIDR IP Addresses allowed to turn on this site's GCP instance"
-}
-
-variable "allowed_ssh_ipv4" {
- type = list(string)
- default = []
- description = "CIDR IPv4 Addresses allowed to to SSH into this site's GCP instance"
-}
-
-variable "allowed_ssh_ipv6" {
- type = list(string)
- default = []
- description = "CIDR IPv6 Addresses allowed to SSH into this site's GCP instance"
-}
-
-variable "run_snapshots" {
- type = bool
- default = false
- description = "Enable daily snapshots of the data disk (recommended for production). Last seven days of snapshots are available. Also weekly snapshots for past year."
-}
-
-variable "overlay_source_instance" {
- type = string
- default = ""
- description = "Name of production instance to get latest snapshot from (e.g., 'ojs-production'). Terraform will automatically use the most recent snapshot from this instance's data disk. Leave empty for production environments."
-}
-
-variable "volume_names" {
- type = list(string)
- default = []
- description = "List of docker volumes to overlay from production snapshot (e.g., ['compose_ojs-public']). Production data is mounted read-only as lower layer, staging writes go to upper layer."
-}
-
-variable "users" {
- type = map(list(string))
- default = {}
- description = "Map of usernames to lists of SSH public keys. Users will be created with docker group membership. Example: { \"alice\" = [\"ssh-rsa AAAA...\"], \"bob\" = [\"ssh-ed25519 AAAA...\", \"ssh-rsa BBBB...\"] }"
-}
-
-variable "rootfs" {
- type = string
- default = ""
- description = "Path to additional rootfs files to copy into the VM. Files will be merged with the base rootfs. Example: '/path/to/custom/rootfs'"
-}
-
-variable "runcmd" {
- type = list(string)
- default = []
- description = "Additional commands to run during cloud-init. Commands are executed after the main initialization."
-}
-
-variable "initcmd" {
- type = list(string)
- default = []
- description = "Commands to run before /home/cloud-compose/run.sh"
-}
-
-variable "artifact_registry_repository" {
- type = string
- default = ""
- description = "Optional Artifact Registry repository name to grant the VM service account reader access to. Leave empty to skip creating the IAM binding."
-}
-
-variable "artifact_registry_location" {
- type = string
- default = "us"
- description = "Artifact Registry location for var.artifact_registry_repository."
-}
-
-variable "frontend" {
- description = <<-EOT
- Optional frontend container to deploy as a sidecar next to ppb. When set,
- ppb continues to power on and ping the VM referenced by machineMetadata,
- but proxies incoming requests to this container on localhost instead of
- to the VM. Use this to serve a frontend from Cloud Run while keeping
- backend services on the VM.
- EOT
- type = object({
- image = string
- port = optional(number, 8080)
- cpu = optional(string, "1000m")
- memory = optional(string, "1Gi")
- })
- default = null
-}
-
-variable "rollout_enabled" {
- description = "Install and run the optional generic rollout HTTP service on the VM."
- type = bool
- default = false
-}
-
-variable "rollout_release_url" {
- description = "HTTPS URL for the pinned rollout Linux binary."
- type = string
- default = ""
-}
-
-variable "rollout_release_sha256" {
- description = "Lowercase SHA256 checksum for var.rollout_release_url."
- type = string
- default = ""
- validation {
- condition = var.rollout_release_sha256 == "" || can(regex("^[0-9a-f]{64}$", var.rollout_release_sha256))
- error_message = "rollout_release_sha256 must be empty or a lowercase SHA256 hex digest."
- }
-}
-
-variable "rollout_port" {
- description = "TCP port exposed by the optional rollout service."
- type = number
- default = 8081
- validation {
- condition = var.rollout_port > 0 && var.rollout_port <= 65535
- error_message = "rollout_port must be between 1 and 65535."
- }
-}
-
-variable "rollout_jwks_uri" {
- description = "JWKS URI used by the rollout service to validate bearer JWTs."
- type = string
- default = ""
-}
-
-variable "rollout_jwt_audience" {
- description = "JWT audience required by the rollout service."
- type = string
- default = ""
-}
-
-variable "rollout_custom_claims" {
- description = "Optional JSON object of additional JWT claims required by the rollout service."
- type = string
- default = ""
-}
-
-variable "rollout_allowed_ipv4" {
- description = "CIDR IPv4 ranges allowed to reach the rollout service port."
- type = list(string)
- default = ["10.0.0.0/8"]
-}
From 1855c444e26dfd626a01a1abe95e96e0283fb292 Mon Sep 17 00:00:00 2001
From: "H.E. Pennypacker" <115990865+pennypacker-he@users.noreply.github.com>
Date: Sun, 5 Jul 2026 19:00:08 +0000
Subject: [PATCH 2/8] [minor] Add template-driven cloud smoke matrix
---
.github/workflows/cloud-smoke-cleanup.yml | 13 +-
.github/workflows/cloud-smoke.yml | 28 +-
.terraform.lock.hcl | 45 ++++
Makefile | 24 +-
README.md | 29 ++-
ci/cloud-smoke.sh | 243 ++++++++++++------
docs/examples.md | 45 +++-
docs/non-gcp-providers.md | 52 ++--
examples/app/main.tf | 39 +++
examples/app/variables.tf | 41 +++
examples/archivesspace/main.tf | 27 ++
examples/archivesspace/variables.tf | 35 +++
examples/digitalocean/main.tf | 11 +-
examples/digitalocean/variables.tf | 4 +-
examples/drupal/main.tf | 42 ++-
examples/drupal/variables.tf | 53 ++--
examples/isle/main.tf | 48 ++--
examples/isle/variables.tf | 73 ++----
examples/linode/main.tf | 11 +-
examples/linode/variables.tf | 4 +-
examples/ojs/README.md | 20 --
examples/ojs/main.tf | 86 ++-----
examples/ojs/terraform.tfvars | 4 -
examples/ojs/variables.tf | 47 ++--
examples/omeka-classic/main.tf | 27 ++
examples/omeka-classic/variables.tf | 35 +++
examples/omeka-s/main.tf | 27 ++
examples/omeka-s/variables.tf | 35 +++
examples/wp/main.tf | 42 ++-
examples/wp/variables.tf | 53 ++--
main.tf | 144 ++++++++++-
modules/gcp/main.tf | 2 +-
outputs.tf | 79 ++++--
.../cloud-compose/install-docker-plugins.sh | 1 +
tests/smoke/app/main.tf | 187 ++++++++++++++
tests/smoke/app/variables.tf | 171 ++++++++++++
.../digitalocean-isle/.terraform.lock.hcl | 47 ----
tests/smoke/digitalocean-isle/main.tf | 88 -------
tests/smoke/digitalocean-isle/variables.tf | 100 -------
tests/smoke/gcp-wp/main.tf | 114 --------
tests/smoke/gcp-wp/variables.tf | 116 ---------
tests/smoke/linode-wp/.terraform.lock.hcl | 44 ----
tests/smoke/linode-wp/main.tf | 87 -------
tests/smoke/linode-wp/variables.tf | 106 --------
variables.tf | 108 +++++++-
45 files changed, 1436 insertions(+), 1201 deletions(-)
create mode 100644 examples/app/main.tf
create mode 100644 examples/app/variables.tf
create mode 100644 examples/archivesspace/main.tf
create mode 100644 examples/archivesspace/variables.tf
delete mode 100644 examples/ojs/README.md
delete mode 100644 examples/ojs/terraform.tfvars
create mode 100644 examples/omeka-classic/main.tf
create mode 100644 examples/omeka-classic/variables.tf
create mode 100644 examples/omeka-s/main.tf
create mode 100644 examples/omeka-s/variables.tf
create mode 100644 tests/smoke/app/main.tf
create mode 100644 tests/smoke/app/variables.tf
delete mode 100644 tests/smoke/digitalocean-isle/.terraform.lock.hcl
delete mode 100644 tests/smoke/digitalocean-isle/main.tf
delete mode 100644 tests/smoke/digitalocean-isle/variables.tf
delete mode 100644 tests/smoke/gcp-wp/main.tf
delete mode 100644 tests/smoke/gcp-wp/variables.tf
delete mode 100644 tests/smoke/linode-wp/.terraform.lock.hcl
delete mode 100644 tests/smoke/linode-wp/main.tf
delete mode 100644 tests/smoke/linode-wp/variables.tf
diff --git a/.github/workflows/cloud-smoke-cleanup.yml b/.github/workflows/cloud-smoke-cleanup.yml
index 1ad2ec9..a69a006 100644
--- a/.github/workflows/cloud-smoke-cleanup.yml
+++ b/.github/workflows/cloud-smoke-cleanup.yml
@@ -21,19 +21,16 @@ jobs:
matrix:
include:
- name: DigitalOcean ISLE
- sweep_target: sweep-digitalocean-isle
- concurrency_target: smoke-test-digitalocean-isle
provider: digitalocean
+ template: isle
- name: Linode WordPress
- sweep_target: sweep-linode-wp
- concurrency_target: smoke-test-linode-wp
provider: linode
+ template: wp
- name: GCP WordPress
- sweep_target: sweep-gcp-wp
- concurrency_target: smoke-test-gcp-wp
provider: gcp
+ template: wp
concurrency:
- group: cloud-compose-smoke-${{ matrix.concurrency_target }}
+ group: cloud-compose-smoke-${{ matrix.provider }}-${{ matrix.template }}
cancel-in-progress: false
env:
CLOUD_COMPOSE_SMOKE_RUN_ID: ${{ github.event.workflow_run.id }}
@@ -61,7 +58,7 @@ jobs:
- name: Sweep smoke resources
if: matrix.provider != 'gcp' || (env.GCLOUD_OIDC_POOL != '' && env.GSA != '' && env.GCLOUD_PROJECT != '')
- run: ci/cloud-smoke.sh ${{ matrix.sweep_target }}
+ run: ci/cloud-smoke.sh sweep-${{ matrix.provider }}-${{ matrix.template }}
- name: Skip GCP cleanup
if: matrix.provider == 'gcp' && (env.GCLOUD_OIDC_POOL == '' || env.GSA == '' || env.GCLOUD_PROJECT == '')
diff --git a/.github/workflows/cloud-smoke.yml b/.github/workflows/cloud-smoke.yml
index 3965a6e..da1e5c4 100644
--- a/.github/workflows/cloud-smoke.yml
+++ b/.github/workflows/cloud-smoke.yml
@@ -41,19 +41,16 @@ jobs:
matrix:
include:
- name: DigitalOcean ISLE
- make_target: smoke-test-digitalocean-isle
- smoke_target: digitalocean-isle
provider: digitalocean
+ template: isle
- name: Linode WordPress
- make_target: smoke-test-linode-wp
- smoke_target: linode-wp
provider: linode
+ template: wp
- name: GCP WordPress
- make_target: smoke-test-gcp-wp
- smoke_target: gcp-wp
provider: gcp
+ template: wp
concurrency:
- group: cloud-compose-smoke-${{ matrix.make_target }}
+ group: cloud-compose-smoke-${{ matrix.provider }}-${{ matrix.template }}
cancel-in-progress: false
env:
CLOUD_COMPOSE_SMOKE_AUTO_APPROVE: "true"
@@ -101,11 +98,11 @@ jobs:
run: ci/install-sitectl-apt.sh
- name: Run smoke test
- run: make ${{ matrix.make_target }}
+ run: make smoke-test PROVIDER=${{ matrix.provider }} TEMPLATE=${{ matrix.template }}
- name: Destroy smoke resources
if: always() && (matrix.provider != 'gcp' || (env.GCLOUD_OIDC_POOL != '' && env.GSA != '' && env.GCLOUD_PROJECT != ''))
- run: ci/cloud-smoke.sh destroy-${{ matrix.smoke_target }}
+ run: ci/cloud-smoke.sh destroy-${{ matrix.provider }}-${{ matrix.template }}
- name: Skip GCP destroy
if: always() && matrix.provider == 'gcp' && (env.GCLOUD_OIDC_POOL == '' || env.GSA == '' || env.GCLOUD_PROJECT == '')
@@ -121,19 +118,16 @@ jobs:
matrix:
include:
- name: DigitalOcean ISLE
- sweep_target: sweep-digitalocean-isle
- concurrency_target: smoke-test-digitalocean-isle
provider: digitalocean
+ template: isle
- name: Linode WordPress
- sweep_target: sweep-linode-wp
- concurrency_target: smoke-test-linode-wp
provider: linode
+ template: wp
- name: GCP WordPress
- sweep_target: sweep-gcp-wp
- concurrency_target: smoke-test-gcp-wp
provider: gcp
+ template: wp
concurrency:
- group: cloud-compose-smoke-${{ matrix.concurrency_target }}
+ group: cloud-compose-smoke-${{ matrix.provider }}-${{ matrix.template }}
cancel-in-progress: false
env:
CLOUD_COMPOSE_SMOKE_RUN_ID: ${{ github.run_id }}
@@ -161,7 +155,7 @@ jobs:
- name: Sweep smoke resources
if: matrix.provider != 'gcp' || (env.GCLOUD_OIDC_POOL != '' && env.GSA != '' && env.GCLOUD_PROJECT != '')
- run: ci/cloud-smoke.sh ${{ matrix.sweep_target }}
+ run: ci/cloud-smoke.sh sweep-${{ matrix.provider }}-${{ matrix.template }}
- name: Skip GCP cleanup
if: matrix.provider == 'gcp' && (env.GCLOUD_OIDC_POOL == '' || env.GSA == '' || env.GCLOUD_PROJECT == '')
diff --git a/.terraform.lock.hcl b/.terraform.lock.hcl
index d09b678..f56a508 100644
--- a/.terraform.lock.hcl
+++ b/.terraform.lock.hcl
@@ -1,6 +1,30 @@
# This file is maintained automatically by "terraform init".
# Manual edits may be lost in future updates.
+provider "registry.terraform.io/digitalocean/digitalocean" {
+ version = "2.93.0"
+ constraints = "~> 2.0"
+ hashes = [
+ "h1:furxWCm/4BbtUX/XHa3TsP0eI+YjQekvcUTyx4BLqnM=",
+ "zh:2509716282fb0d04027279b2d6ffb449d5f4b4a5f380a2ad7b7b6221d2f2fdc4",
+ "zh:3a6407123d127b6948040583c29371b6ea92120d2a239d8bcd27673725673013",
+ "zh:71443c90f85572fce0c563e3587d956afb8be9f0a0090f1c40b33b1005718824",
+ "zh:790c8a3694baba6e28b13d45d86523995ffda4693e0c8ad1584e34deee914fe2",
+ "zh:7fe00fd5d4d322923550651b6ebca9dea14b3b7a68c09ba4c20f9b416a34cb40",
+ "zh:8bf4d5ccb634bacba929fc632d554eddb349b890d26e5f4dbcb53481ca34dbff",
+ "zh:8f545ec1622fa4d42a7112de8cbd0c42f8967e8dafd5c514d77b7ec25914951d",
+ "zh:98300c632e9eabdcecb9f77586a4a48e19dab62b7365410f4ab857ab4007e159",
+ "zh:9db648994459fe62a9e91f9d875dd9220db5b063a00f4eec22dbdf2247a67730",
+ "zh:9f21713916718613da2a42c8b39c503e46399b2d06c3b492979bde939d05d2bb",
+ "zh:a4b4afa0ef6f672d50ac072cae1a39ec6d97716e4ed118900b5db1a553a3c1cd",
+ "zh:bebed73ab49be830ef03346cb91e1da83fff06b555695f69fc3de13c51a456ec",
+ "zh:d207d54f3ab86a0f71c194b8b34a49a219f97dd40ec6db0ed13ed70df9f26aab",
+ "zh:ee4caa17a2e62bfa9c2669ddd909026a3ded3294c4f2bb325cf563f5766e1981",
+ "zh:efb59a5436f103a4930a7cab2e77ba75d31fd08f2f024c9a4177c70a89cd3264",
+ "zh:ffaf97ab916b12c2181bdf5f7232aaac88cce59bb8edbad07a527207da232f90",
+ ]
+}
+
provider "registry.terraform.io/hashicorp/cloudinit" {
version = "2.4.0"
constraints = "~> 2.3"
@@ -72,3 +96,24 @@ provider "registry.terraform.io/hashicorp/time" {
"zh:c239c619101a8c95e1f14061eb973c57a8d15fa0e68878ced5bbd76858ee5b79",
]
}
+
+provider "registry.terraform.io/linode/linode" {
+ version = "4.0.0"
+ constraints = "~> 4.0"
+ hashes = [
+ "h1:ZUykBGGXIJsXzafpxxKN+oRJh/n/d+jFiiTZlYVDrvY=",
+ "zh:01e0045344d13ca61c8b065df73b007bf45f665eb419d045a31c8d9ba48ede86",
+ "zh:3e22a4672940ec1a8c59bd6c8d594a6fb4bdfc50efa993ac2b9edd21a9459b03",
+ "zh:467c82a79a04cc2f279b4b8206db691035dbcb3ba88f8a29a63e060046a7747b",
+ "zh:4d7f3a1ec9dfa15ea2bac0f9670885812d09e45737d55c7daea049770143bc1d",
+ "zh:4d9b946d66940231488990943f9564725891310f8500c149af380eba614f5ab4",
+ "zh:75b48ac11262ac401c2fc3eb5fb73b01ad1607a1c2a0ddcb42687d1941158e6d",
+ "zh:864de67a080eeb4b14902056dc96bd29f1dc935442440cdb774ad2d46a872ca9",
+ "zh:a3fd99fb4f9b2e631c63b0ab9ff4d28e32aca4ff0a14b9271fdc634798ecc808",
+ "zh:b0c63ea32e65a76e987a086dc4ee6d8f445876a59d7a5a94aa2f225f5fd8729f",
+ "zh:b3d6f4461724983798af50bc91003b0e7892a5b2ab172d7fd0a8d57578c6a7bf",
+ "zh:b5f2643c36657241b6ef4a987727e99352ed2dcf63d54cba6d5292ee0edd59f4",
+ "zh:bf148ad0a4cdd049de12bdea2dc2bb20f2a0e09574a1917f7e45c1f54aa8dc0b",
+ "zh:d1448b79e1c9c9d14adc03c97730f68fec042011012ec6727ff7b17d7e130df4",
+ ]
+}
diff --git a/Makefile b/Makefile
index e043b7d..8e51f0d 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: lint lint-check terraform-fmt terraform-fmt-check terraform-validate terraform-lint-check shell-lint terraform-docs smoke-test-clouds smoke-test-digitalocean-isle smoke-test-linode-wp smoke-test-gcp-wp destroy-smoke-digitalocean-isle destroy-smoke-linode-wp destroy-smoke-gcp-wp docs docs-docker-build docs-build docs-serve docs-preview docs-clean
+.PHONY: lint lint-check terraform-fmt terraform-fmt-check terraform-validate terraform-lint-check shell-lint terraform-docs smoke-test-clouds smoke-test smoke-test-digitalocean-isle smoke-test-linode-wp smoke-test-gcp-wp destroy-smoke destroy-smoke-digitalocean-isle destroy-smoke-linode-wp destroy-smoke-gcp-wp docs docs-docker-build docs-build docs-serve docs-preview docs-clean
DOCS_IMAGE ?= cloud-compose-docs
DOCS_PORT ?= 8888
@@ -31,23 +31,33 @@ terraform-docs:
smoke-test-clouds:
ci/cloud-smoke.sh all
+smoke-test:
+ @test -n "$(PROVIDER)" || { echo "PROVIDER is required"; exit 2; }
+ @test -n "$(TEMPLATE)" || { echo "TEMPLATE is required"; exit 2; }
+ ci/cloud-smoke.sh $(PROVIDER)-$(TEMPLATE)
+
smoke-test-digitalocean-isle:
- ci/cloud-smoke.sh digitalocean-isle
+ $(MAKE) smoke-test PROVIDER=digitalocean TEMPLATE=isle
smoke-test-linode-wp:
- ci/cloud-smoke.sh linode-wp
+ $(MAKE) smoke-test PROVIDER=linode TEMPLATE=wp
smoke-test-gcp-wp:
- ci/cloud-smoke.sh gcp-wp
+ $(MAKE) smoke-test PROVIDER=gcp TEMPLATE=wp
+
+destroy-smoke:
+ @test -n "$(PROVIDER)" || { echo "PROVIDER is required"; exit 2; }
+ @test -n "$(TEMPLATE)" || { echo "TEMPLATE is required"; exit 2; }
+ ci/cloud-smoke.sh destroy-$(PROVIDER)-$(TEMPLATE)
destroy-smoke-digitalocean-isle:
- ci/cloud-smoke.sh destroy-digitalocean-isle
+ $(MAKE) destroy-smoke PROVIDER=digitalocean TEMPLATE=isle
destroy-smoke-linode-wp:
- ci/cloud-smoke.sh destroy-linode-wp
+ $(MAKE) destroy-smoke PROVIDER=linode TEMPLATE=wp
destroy-smoke-gcp-wp:
- ci/cloud-smoke.sh destroy-gcp-wp
+ $(MAKE) destroy-smoke PROVIDER=gcp TEMPLATE=wp
docs: docs-build
diff --git a/README.md b/README.md
index 2b13806..f023fc8 100644
--- a/README.md
+++ b/README.md
@@ -7,7 +7,7 @@ Cloud; provider modules under `modules/` cover DigitalOcean and Linode.
## Requirements
| Name | Version |
-| ---- | ------- |
+|------|---------|
| [terraform](#requirement\_terraform) | >= 1.2.4 |
## Providers
@@ -17,8 +17,10 @@ No providers.
## Modules
| Name | Source | Version |
-| ---- | ------ | ------- |
+|------|--------|---------|
+| [digitalocean](#module\_digitalocean) | ./modules/digitalocean | n/a |
| [gcp](#module\_gcp) | ./modules/gcp | n/a |
+| [linode](#module\_linode) | ./modules/linode | n/a |
## Resources
@@ -27,24 +29,31 @@ No resources.
## Inputs
| Name | Description | Type | Default | Required |
-| ---- | ----------- | ---- | ------- | :------: |
-| [gcp](#input\_gcp) | Google Cloud infrastructure settings. | object({
project_id = string
project_number = string
region = optional(string, "us-east5")
zone = optional(string, "us-east5-b")
identity = optional(object({
vm_service_account_email = optional(string, "")
app_service_account_email = optional(string, "")
}), {})
instance = optional(object({
machine_type = optional(string, "n4-standard-2")
os = optional(string, "cos-125-19216-220-185")
production = optional(bool, false)
}), {})
disks = optional(object({
type = optional(string, "hyperdisk-balanced")
docker_volumes_size_gb = optional(number, 50)
}), {})
network = optional(object({
create = optional(bool, true)
name = optional(string, "")
subnetwork = optional(string, "")
ip_cidr_range = optional(string, "10.42.0.0/24")
power_button_allowed_ips = optional(list(string), [])
ssh_ipv4 = optional(list(string), [])
ssh_ipv6 = optional(list(string), [])
}), {})
snapshots = optional(object({
enabled = optional(bool, false)
}), {})
overlay = optional(object({
source_instance = optional(string, "")
volume_names = optional(list(string), [])
}), {})
cloud_init = optional(object({
initcmd = optional(list(string), [])
runcmd = optional(list(string), [])
}), {})
artifact_registry = optional(object({
repository = optional(string, "")
location = optional(string, "us")
}), {})
power_management = optional(object({
enabled = optional(bool, true)
frontend = optional(object({
image = string
port = optional(number, 8080)
cpu = optional(string, "1000m")
memory = optional(string, "1Gi")
}), null)
}), {})
rollout = optional(object({
enabled = optional(bool, false)
release_url = optional(string, "")
release_sha256 = optional(string, "")
port = optional(number, 8081)
jwks_uri = optional(string, "")
jwt_audience = optional(string, "")
custom_claims = optional(string, "")
allowed_ipv4 = optional(list(string), ["10.0.0.0/8"])
}), {})
}) | n/a | yes |
+|------|-------------|------|---------|:--------:|
| [name](#input\_name) | Deployment name. | `string` | n/a | yes |
-| [runtime](#input\_runtime) | Provider-neutral compose/runtime settings. | object({
rootfs = optional(string, "")
users = optional(map(list(string)), {})
compose = optional(object({
primary = optional(string, "")
ingress_port = optional(number, 80)
ingress = optional(object({
letsencrypt = optional(bool, false)
bot_mitigation = optional(bool, false)
mode = optional(string, "")
domain = optional(string, "")
acme_email = optional(string, "")
trusted_ips = optional(list(string), [])
max_upload_size = optional(string, "")
upload_timeout = optional(string, "")
}), {})
repo = optional(string, "")
branch = optional(string, "main")
projects = optional(map(object({
docker_compose_repo = string
docker_compose_branch = optional(string)
project_dir = optional(string)
compose_project_name = optional(string)
ingress_port = optional(number)
ingress = optional(object({
letsencrypt = optional(bool)
bot_mitigation = optional(bool)
mode = optional(string)
domain = optional(string)
acme_email = optional(string)
trusted_ips = optional(list(string))
max_upload_size = optional(string)
upload_timeout = optional(string)
}), {})
sitectl_context_name = optional(string)
sitectl_plugin = optional(string)
sitectl_environment = optional(string)
sitectl_packages = optional(list(string), [])
sitectl_verify_args = optional(list(string), [])
docker_compose_init = optional(list(string))
docker_compose_up = optional(list(string))
docker_compose_down = optional(list(string))
docker_compose_rollout = optional(list(string))
})), {})
init = optional(list(string), [
"sitectl config set-context \"$${SITECTL_CONTEXT_NAME}\" --type local --project-dir \"$${DOCKER_COMPOSE_DIR}\" --site \"$${CLOUD_COMPOSE_INSTANCE_NAME}\" --plugin \"$${SITECTL_PLUGIN}\" --environment \"$${SITECTL_ENVIRONMENT}\" --project-name \"$${CLOUD_COMPOSE_INSTANCE_NAME}\" --compose-project-name \"$${COMPOSE_PROJECT_NAME}\" --docker-socket /var/run/docker.sock --env-file .env --default"
])
up = optional(list(string), [
"sitectl compose --context \"$${SITECTL_CONTEXT_NAME}\" up -d --remove-orphans",
"sitectl healthcheck --context \"$${SITECTL_CONTEXT_NAME}\" --persist --timeout \"$${SITECTL_HEALTHCHECK_TIMEOUT}\" --interval \"$${SITECTL_HEALTHCHECK_INTERVAL}\"",
"if [ \"$${SITECTL_ENVIRONMENT}\" != \"production\" ]; then sitectl verify --context \"$${SITECTL_CONTEXT_NAME}\" $${SITECTL_VERIFY_ARGS:-}; fi"
])
down = optional(list(string), [
"sitectl compose --context \"$${SITECTL_CONTEXT_NAME}\" down"
])
rollout = optional(list(string), [
"TARGET_REF=\"$${GIT_REF:-$${GIT_BRANCH:-$${DOCKER_COMPOSE_BRANCH:-main}}}\"",
"if [ -x ./scripts/rollout.sh ]; then ./scripts/rollout.sh; else sitectl deploy --context \"$${SITECTL_CONTEXT_NAME}\" --branch \"$TARGET_REF\"; fi",
"sitectl healthcheck --context \"$${SITECTL_CONTEXT_NAME}\" --persist --timeout \"$${SITECTL_HEALTHCHECK_TIMEOUT}\" --interval \"$${SITECTL_HEALTHCHECK_INTERVAL}\"",
"if [ \"$${SITECTL_ENVIRONMENT}\" != \"production\" ]; then sitectl verify --context \"$${SITECTL_CONTEXT_NAME}\" $${SITECTL_VERIFY_ARGS:-}; fi"
])
}), {})
sitectl = optional(object({
packages = optional(list(string), ["sitectl"])
version = optional(string, "latest")
context_name = optional(string, "")
plugin = optional(string, "core")
environment = optional(string, "production")
healthcheck_timeout = optional(string, "10m")
healthcheck_interval = optional(string, "15s")
verify_args = optional(list(string), [])
}), {})
docker = optional(object({
# renovate: datasource=github-releases depName=docker-compose packageName=docker/compose versioning=semver
compose_version = optional(string, "v5.2.0")
# renovate: datasource=github-releases depName=docker-buildx packageName=docker/buildx versioning=semver
buildx_version = optional(string, "v0.35.0")
}), {})
managed_runtime = optional(object({
enabled = optional(bool, true)
internal_services_enabled = optional(bool, true)
internal_services_auto_update = optional(bool, true)
lightsout_image = optional(string, "ghcr.io/libops/lightsout:main")
cap_image = optional(string, "ghcr.io/libops/cap:main")
cadvisor_image = optional(string, "ghcr.io/google/cadvisor:v0.57.0@sha256:e75bdb03b74b0b6995f208f166fead2e6e555dde73e44200113bb26f41b1981d")
artifacts = optional(list(object({
name = string
url = string
sha256 = string
path = string
mode = optional(string, "0755")
owner = optional(string, "root")
group = optional(string, "root")
restart = optional(string, "")
})), [])
}), {})
vault = optional(object({
addr = optional(string, "")
namespace = optional(string, "")
role = optional(string, "")
agent_enabled = optional(bool, false)
auth_method = optional(string, "gcp-iam")
gcp_auth_mount_path = optional(string, "auth/gcp")
agent_token_path = optional(string, "/mnt/disks/data/vault/token")
agent_additional_config = optional(string, "")
agent_templates = optional(list(object({
destination = string
contents = string
perms = optional(string, "0640")
command = optional(string, "")
})), [])
}), {})
}) | `{}` | no |
+| [cloud\_provider](#input\_cloud\_provider) | Cloud provider to deploy to. Supported values are gcp, digitalocean, and linode. | `string` | `"gcp"` | no |
+| [digitalocean](#input\_digitalocean) | DigitalOcean infrastructure settings. | object({
region = optional(string, "tor1")
tags = optional(list(string), ["cloud-compose"])
droplet = optional(object({
size = optional(string, "s-2vcpu-4gb")
image = optional(string, "ubuntu-24-04-x64")
ssh_keys = optional(list(string), [])
vpc_uuid = optional(string, null)
monitoring = optional(bool, true)
ipv6 = optional(bool, true)
backups = optional(bool, false)
}), {})
ssh = optional(object({
cloud_compose_keys = optional(list(string), [])
users = optional(map(list(string)), {})
}), {})
volumes = optional(object({
data_size_gb = optional(number, 50)
docker_volumes_size_gb = optional(number, 100)
}), {})
firewall = optional(object({
enabled = optional(bool, true)
ssh_source_addresses = optional(list(string), ["0.0.0.0/0", "::/0"])
web_source_addresses = optional(list(string), ["0.0.0.0/0", "::/0"])
}), {})
}) | `{}` | no |
+| [gcp](#input\_gcp) | Google Cloud infrastructure settings. | object({
project_id = optional(string, "")
project_number = optional(string, "")
region = optional(string, "us-east5")
zone = optional(string, "us-east5-b")
identity = optional(object({
vm_service_account_email = optional(string, "")
app_service_account_email = optional(string, "")
}), {})
instance = optional(object({
machine_type = optional(string, "n4-standard-2")
os = optional(string, "cos-125-19216-220-185")
production = optional(bool, false)
}), {})
disks = optional(object({
type = optional(string, "hyperdisk-balanced")
docker_volumes_size_gb = optional(number, 50)
}), {})
network = optional(object({
create = optional(bool, true)
name = optional(string, "")
subnetwork = optional(string, "")
ip_cidr_range = optional(string, "10.42.0.0/24")
power_button_allowed_ips = optional(list(string), [])
ssh_ipv4 = optional(list(string), [])
ssh_ipv6 = optional(list(string), [])
}), {})
snapshots = optional(object({
enabled = optional(bool, false)
}), {})
overlay = optional(object({
source_instance = optional(string, "")
volume_names = optional(list(string), [])
}), {})
cloud_init = optional(object({
initcmd = optional(list(string), [])
runcmd = optional(list(string), [])
}), {})
artifact_registry = optional(object({
repository = optional(string, "")
location = optional(string, "us")
}), {})
power_management = optional(object({
enabled = optional(bool, true)
frontend = optional(object({
image = string
port = optional(number, 8080)
cpu = optional(string, "1000m")
memory = optional(string, "1Gi")
}), null)
}), {})
rollout = optional(object({
enabled = optional(bool, false)
release_url = optional(string, "")
release_sha256 = optional(string, "")
port = optional(number, 8081)
jwks_uri = optional(string, "")
jwt_audience = optional(string, "")
custom_claims = optional(string, "")
allowed_ipv4 = optional(list(string), ["10.0.0.0/8"])
}), {})
}) | `{}` | no |
+| [linode](#input\_linode) | Linode infrastructure settings. | object({
region = optional(string, "us-east")
tags = optional(list(string), ["cloud-compose"])
instance = optional(object({
type = optional(string, "g6-standard-2")
image = optional(string, "linode/ubuntu22.04")
authorized_keys = optional(list(string), [])
authorized_users = optional(list(string), [])
root_pass = optional(string, null)
private_ip = optional(bool, true)
backups_enabled = optional(bool, false)
watchdog_enabled = optional(bool, true)
}), {})
ssh = optional(object({
cloud_compose_keys = optional(list(string), [])
users = optional(map(list(string)), {})
}), {})
volumes = optional(object({
data_size_gb = optional(number, 50)
docker_volumes_size_gb = optional(number, 100)
}), {})
firewall = optional(object({
enabled = optional(bool, true)
ssh_source_ipv4 = optional(list(string), ["0.0.0.0/0"])
ssh_source_ipv6 = optional(list(string), ["::/0"])
web_source_ipv4 = optional(list(string), ["0.0.0.0/0"])
web_source_ipv6 = optional(list(string), ["::/0"])
}), {})
}) | `{}` | no |
+| [runtime](#input\_runtime) | Provider-neutral compose/runtime settings. | object({
rootfs = optional(string, "")
rootfs_archive_url = optional(string, "")
rootfs_archive_sha256 = optional(string, "")
users = optional(map(list(string)), {})
compose = optional(object({
primary = optional(string, "")
ingress_port = optional(number, 80)
ingress = optional(object({
letsencrypt = optional(bool, false)
bot_mitigation = optional(bool, false)
mode = optional(string, "")
domain = optional(string, "")
acme_email = optional(string, "")
trusted_ips = optional(list(string), [])
max_upload_size = optional(string, "")
upload_timeout = optional(string, "")
}), {})
repo = optional(string, "")
branch = optional(string, "main")
projects = optional(map(object({
docker_compose_repo = string
docker_compose_branch = optional(string)
project_dir = optional(string)
compose_project_name = optional(string)
ingress_port = optional(number)
ingress = optional(object({
letsencrypt = optional(bool)
bot_mitigation = optional(bool)
mode = optional(string)
domain = optional(string)
acme_email = optional(string)
trusted_ips = optional(list(string))
max_upload_size = optional(string)
upload_timeout = optional(string)
}), {})
sitectl_context_name = optional(string)
sitectl_plugin = optional(string)
sitectl_environment = optional(string)
sitectl_packages = optional(list(string), [])
sitectl_verify_args = optional(list(string), [])
docker_compose_init = optional(list(string))
docker_compose_up = optional(list(string))
docker_compose_down = optional(list(string))
docker_compose_rollout = optional(list(string))
})), {})
init = optional(list(string), [
"sitectl config set-context \"$${SITECTL_CONTEXT_NAME}\" --type local --project-dir \"$${DOCKER_COMPOSE_DIR}\" --site \"$${CLOUD_COMPOSE_INSTANCE_NAME}\" --plugin \"$${SITECTL_PLUGIN}\" --environment \"$${SITECTL_ENVIRONMENT}\" --project-name \"$${CLOUD_COMPOSE_INSTANCE_NAME}\" --compose-project-name \"$${COMPOSE_PROJECT_NAME}\" --docker-socket /var/run/docker.sock --env-file .env --default"
])
up = optional(list(string), [
"sitectl compose --context \"$${SITECTL_CONTEXT_NAME}\" up -d --remove-orphans",
"sitectl healthcheck --context \"$${SITECTL_CONTEXT_NAME}\" --persist --timeout \"$${SITECTL_HEALTHCHECK_TIMEOUT}\" --interval \"$${SITECTL_HEALTHCHECK_INTERVAL}\"",
"if [ \"$${SITECTL_ENVIRONMENT}\" != \"production\" ]; then sitectl verify --context \"$${SITECTL_CONTEXT_NAME}\" $${SITECTL_VERIFY_ARGS:-}; fi"
])
down = optional(list(string), [
"sitectl compose --context \"$${SITECTL_CONTEXT_NAME}\" down"
])
rollout = optional(list(string), [
"TARGET_REF=\"$${GIT_REF:-$${GIT_BRANCH:-$${DOCKER_COMPOSE_BRANCH:-main}}}\"",
"if [ -x ./scripts/rollout.sh ]; then ./scripts/rollout.sh; else sitectl deploy --context \"$${SITECTL_CONTEXT_NAME}\" --branch \"$TARGET_REF\"; fi",
"sitectl healthcheck --context \"$${SITECTL_CONTEXT_NAME}\" --persist --timeout \"$${SITECTL_HEALTHCHECK_TIMEOUT}\" --interval \"$${SITECTL_HEALTHCHECK_INTERVAL}\"",
"if [ \"$${SITECTL_ENVIRONMENT}\" != \"production\" ]; then sitectl verify --context \"$${SITECTL_CONTEXT_NAME}\" $${SITECTL_VERIFY_ARGS:-}; fi"
])
}), {})
sitectl = optional(object({
packages = optional(list(string), ["sitectl"])
version = optional(string, "latest")
context_name = optional(string, "")
plugin = optional(string, "core")
environment = optional(string, "production")
healthcheck_timeout = optional(string, "10m")
healthcheck_interval = optional(string, "15s")
verify_args = optional(list(string), [])
}), {})
docker = optional(object({
# renovate: datasource=github-releases depName=docker-compose packageName=docker/compose versioning=semver
compose_version = optional(string, "v5.2.0")
# renovate: datasource=github-releases depName=docker-buildx packageName=docker/buildx versioning=semver
buildx_version = optional(string, "v0.35.0")
}), {})
managed_runtime = optional(object({
enabled = optional(bool, true)
internal_services_enabled = optional(bool, true)
internal_services_auto_update = optional(bool, true)
lightsout_image = optional(string, "ghcr.io/libops/lightsout:main")
cap_image = optional(string, "ghcr.io/libops/cap:main")
cadvisor_image = optional(string, "ghcr.io/google/cadvisor:v0.57.0@sha256:e75bdb03b74b0b6995f208f166fead2e6e555dde73e44200113bb26f41b1981d")
artifacts = optional(list(object({
name = string
url = string
sha256 = string
path = string
mode = optional(string, "0755")
owner = optional(string, "root")
group = optional(string, "root")
restart = optional(string, "")
})), [])
}), {})
vault = optional(object({
addr = optional(string, "")
namespace = optional(string, "")
role = optional(string, "")
agent_enabled = optional(bool, false)
auth_method = optional(string, "gcp-iam")
gcp_auth_mount_path = optional(string, "auth/gcp")
agent_token_path = optional(string, "/mnt/disks/data/vault/token")
agent_additional_config = optional(string, "")
agent_templates = optional(list(object({
destination = string
contents = string
perms = optional(string, "0640")
command = optional(string, "")
})), [])
}), {})
extra_env = optional(map(string), {})
}) | `{}` | no |
+| [template](#input\_template) | Optional compose template preset. Supported values are archivesspace, ojs, isle, drupal, wp, omeka-s, and omeka-classic. Explicit runtime settings override preset defaults. | `string` | `""` | no |
## Outputs
| Name | Description |
-| ---- | ----------- |
+|------|-------------|
| [appGsa](#output\_appGsa) | The Google Service Account the app can use for app-scoped auth. |
| [backend](#output\_backend) | Backend service ID for attaching Cloud Run ingress to an external HTTPS load balancer. |
+| [cloud\_provider](#output\_cloud\_provider) | Selected cloud provider. |
| [compose\_projects](#output\_compose\_projects) | Normalized compose project manifest. |
-| [external\_ip](#output\_external\_ip) | The Google Compute instance external IPv4 address. |
-| [instance](#output\_instance) | The Google Compute instance ID, name, zone, data disk, and GSA. |
-| [instance\_id](#output\_instance\_id) | The Google Compute instance ID. |
-| [internal\_ip](#output\_internal\_ip) | The Google Compute instance internal IPv4 address. |
+| [external\_ip](#output\_external\_ip) | Selected provider VM public IPv4 address. |
+| [instance](#output\_instance) | Selected provider VM instance details. |
+| [instance\_id](#output\_instance\_id) | Selected provider VM instance ID. |
+| [internal\_ip](#output\_internal\_ip) | Selected provider VM private IPv4 address. |
| [primary\_compose\_project](#output\_primary\_compose\_project) | Normalized primary compose project. |
| [rollout](#output\_rollout) | Optional rollout API endpoint details. |
| [serviceGsa](#output\_serviceGsa) | The Google Service Account internal services run as. |
+| [template](#output\_template) | Selected compose template preset. |
| [urls](#output\_urls) | Cloud Run ingress URLs by region. |
+| [volumes](#output\_volumes) | Selected provider persistent volume details where available. |
diff --git a/ci/cloud-smoke.sh b/ci/cloud-smoke.sh
index 25c63a2..1b80bb5 100755
--- a/ci/cloud-smoke.sh
+++ b/ci/cloud-smoke.sh
@@ -8,21 +8,20 @@ usage() {
cat <<'EOF'
Usage:
ci/cloud-smoke.sh all
+ ci/cloud-smoke.sh -
+ ci/cloud-smoke.sh destroy--
+ ci/cloud-smoke.sh sweep
+ ci/cloud-smoke.sh sweep--
+
+Examples:
ci/cloud-smoke.sh digitalocean-isle
ci/cloud-smoke.sh linode-wp
ci/cloud-smoke.sh gcp-wp
- ci/cloud-smoke.sh destroy-digitalocean-isle
- ci/cloud-smoke.sh destroy-linode-wp
- ci/cloud-smoke.sh destroy-gcp-wp
- ci/cloud-smoke.sh sweep
- ci/cloud-smoke.sh sweep-digitalocean-isle
- ci/cloud-smoke.sh sweep-linode-wp
- ci/cloud-smoke.sh sweep-gcp-wp
Required environment:
- DIGITALOCEAN_TOKEN DigitalOcean API token for digitalocean-isle.
- LINODE_TOKEN Linode API token for linode-wp.
- GCLOUD_PROJECT Google Cloud project for gcp-wp.
+ DIGITALOCEAN_TOKEN DigitalOcean API token for digitalocean targets.
+ LINODE_TOKEN Linode API token for linode targets.
+ GCLOUD_PROJECT Google Cloud project for gcp targets.
Optional environment:
CLOUD_COMPOSE_SMOKE_AUTO_APPROVE=true Pass -auto-approve outside GitHub Actions.
@@ -34,9 +33,10 @@ Optional environment:
CLOUD_COMPOSE_SMOKE_SWEEP_ORPHANS=true
Remove prior smoke resources for the same target before apply.
CLOUD_COMPOSE_SMOKE_RUN_ID Optional run id used to target provider cleanup.
+ CLOUD_COMPOSE_SMOKE_TARGETS Space-separated targets used by "all" and "sweep".
DIGITALOCEAN_API_TOKEN Backward-compatible alias for DIGITALOCEAN_TOKEN.
- GCLOUD_REGION=us-east5 Google Cloud region for gcp-wp.
- GCLOUD_ZONE=us-east5-b Google Cloud zone for gcp-wp.
+ GCLOUD_REGION=us-east5 Google Cloud region for gcp targets.
+ GCLOUD_ZONE=us-east5-b Google Cloud zone for gcp targets.
EOF
}
@@ -54,11 +54,22 @@ require_env() {
fi
}
-target_root() {
+default_targets() {
+ printf '%s\n' "${CLOUD_COMPOSE_SMOKE_TARGETS:-digitalocean-isle linode-wp gcp-wp}"
+}
+
+valid_template() {
+ case "$1" in
+ archivesspace | ojs | isle | drupal | wp | omeka-s | omeka-classic) return 0 ;;
+ *) return 1 ;;
+ esac
+}
+
+target_provider() {
case "$1" in
- digitalocean-isle) printf '%s/tests/smoke/digitalocean-isle\n' "$repo_root" ;;
- linode-wp) printf '%s/tests/smoke/linode-wp\n' "$repo_root" ;;
- gcp-wp) printf '%s/tests/smoke/gcp-wp\n' "$repo_root" ;;
+ digitalocean-*) printf 'digitalocean\n' ;;
+ linode-*) printf 'linode\n' ;;
+ gcp-*) printf 'gcp\n' ;;
*)
echo "Unknown smoke target: $1" >&2
usage >&2
@@ -67,18 +78,36 @@ target_root() {
esac
}
+target_template() {
+ local target="$1" provider template
+
+ provider="$(target_provider "$target")"
+ template="${target#"$provider"-}"
+ if ! valid_template "$template"; then
+ echo "Unknown smoke template in target: $target" >&2
+ usage >&2
+ exit 2
+ fi
+ printf '%s\n' "$template"
+}
+
+target_root() {
+ target_template "$1" >/dev/null
+ printf '%s/tests/smoke/app\n' "$repo_root"
+}
+
target_env() {
- case "$1" in
- digitalocean-isle)
+ case "$(target_provider "$1")" in
+ digitalocean)
if [[ -z "${DIGITALOCEAN_TOKEN:-}" && -n "${DIGITALOCEAN_API_TOKEN:-}" ]]; then
export DIGITALOCEAN_TOKEN="$DIGITALOCEAN_API_TOKEN"
fi
require_env DIGITALOCEAN_TOKEN
;;
- linode-wp)
+ linode)
require_env LINODE_TOKEN
;;
- gcp-wp)
+ gcp)
require_env GCLOUD_PROJECT
export GOOGLE_PROJECT="${GOOGLE_PROJECT:-$GCLOUD_PROJECT}"
export GOOGLE_CLOUD_PROJECT="${GOOGLE_CLOUD_PROJECT:-$GCLOUD_PROJECT}"
@@ -180,46 +209,84 @@ smoke_run_tag() {
printf 'gha-run-%s\n' "$run_id"
}
+template_slug() {
+ case "$1" in
+ archivesspace) printf 'as\n' ;;
+ ojs) printf 'ojs\n' ;;
+ isle) printf 'isle\n' ;;
+ drupal) printf 'dr\n' ;;
+ wp) printf 'wp\n' ;;
+ omeka-s) printf 'os\n' ;;
+ omeka-classic) printf 'oc\n' ;;
+ *)
+ echo "Unknown smoke template: $1" >&2
+ exit 2
+ ;;
+ esac
+}
+
+provider_slug() {
+ case "$1" in
+ digitalocean) printf 'do\n' ;;
+ gcp) printf 'g\n' ;;
+ linode) printf 'ln\n' ;;
+ *)
+ echo "Unknown smoke provider: $1" >&2
+ exit 2
+ ;;
+ esac
+}
+
+target_name_prefix() {
+ local target="$1" provider template
+
+ provider="$(target_provider "$target")"
+ template="$(target_template "$target")"
+ printf 'cc-%s-%s\n' "$(provider_slug "$provider")" "$(template_slug "$template")"
+}
+
provider_tag_cleanup() {
- local target="$1" run_id="${2:-}" run_tag run_fragment
+ local target="$1" run_id="${2:-}" run_tag run_fragment provider name_prefix
run_tag="$(smoke_run_tag "$run_id")"
run_fragment=""
if [[ -n "$run_id" ]]; then
run_fragment="-$(printf '%s' "$run_id" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9-]/-/g' | cut -c1-16)-"
fi
+ provider="$(target_provider "$target")"
+ name_prefix="$(target_name_prefix "$target")"
- case "$target" in
- digitalocean-isle)
+ case "$provider" in
+ digitalocean)
api_get digitalocean "/firewalls?per_page=200" |
- jq -r --arg run_fragment "$run_fragment" '.firewalls[]? | select(.name | startswith("cc-do-isle-")) | select($run_fragment == "" or (.name | contains($run_fragment))) | .id' |
+ jq -r --arg name_prefix "${name_prefix}-" --arg run_fragment "$run_fragment" '.firewalls[]? | select(.name | startswith($name_prefix)) | select($run_fragment == "" or (.name | contains($run_fragment))) | .id' |
delete_ids digitalocean "/firewalls"
api_get digitalocean "/droplets?tag_name=cloud-compose-smoke&per_page=200" |
- jq -r --arg run_tag "$run_tag" '.droplets[]? | select((.tags // []) | index("digitalocean-isle")) | select($run_tag == "" or ((.tags // []) | index($run_tag))) | .id' |
+ jq -r --arg target "$target" --arg run_tag "$run_tag" '.droplets[]? | select((.tags // []) | index($target)) | select($run_tag == "" or ((.tags // []) | index($run_tag))) | .id' |
delete_ids digitalocean "/droplets"
sleep 10
api_get digitalocean "/volumes?tag_name=cloud-compose-smoke&per_page=200" |
- jq -r --arg run_tag "$run_tag" '.volumes[]? | select((.tags // []) | index("digitalocean-isle")) | select($run_tag == "" or ((.tags // []) | index($run_tag))) | .id' |
+ jq -r --arg target "$target" --arg run_tag "$run_tag" '.volumes[]? | select((.tags // []) | index($target)) | select($run_tag == "" or ((.tags // []) | index($run_tag))) | .id' |
delete_ids digitalocean "/volumes"
;;
- linode-wp)
+ linode)
api_get linode "/networking/firewalls?page_size=500" |
- jq -r --arg run_tag "$run_tag" '.data[]? | select((.tags // []) | index("cloud-compose-smoke") and index("linode-wp")) | select($run_tag == "" or ((.tags // []) | index($run_tag))) | .id' |
+ jq -r --arg target "$target" --arg run_tag "$run_tag" '.data[]? | select((.tags // []) | index("cloud-compose-smoke") and index($target)) | select($run_tag == "" or ((.tags // []) | index($run_tag))) | .id' |
delete_ids linode "/networking/firewalls"
api_get linode "/linode/instances?page_size=500" |
- jq -r --arg run_tag "$run_tag" '.data[]? | select((.tags // []) | index("cloud-compose-smoke") and index("linode-wp")) | select($run_tag == "" or ((.tags // []) | index($run_tag))) | .id' |
+ jq -r --arg target "$target" --arg run_tag "$run_tag" '.data[]? | select((.tags // []) | index("cloud-compose-smoke") and index($target)) | select($run_tag == "" or ((.tags // []) | index($run_tag))) | .id' |
delete_ids linode "/linode/instances"
sleep 10
api_get linode "/volumes?page_size=500" |
- jq -r --arg run_tag "$run_tag" '.data[]? | select((.tags // []) | index("cloud-compose-smoke") and index("linode-wp")) | select($run_tag == "" or ((.tags // []) | index($run_tag))) | .id' |
+ jq -r --arg target "$target" --arg run_tag "$run_tag" '.data[]? | select((.tags // []) | index("cloud-compose-smoke") and index($target)) | select($run_tag == "" or ((.tags // []) | index($run_tag))) | .id' |
delete_ids linode "/volumes"
;;
- gcp-wp)
+ gcp)
local project name_filter
project="$GCLOUD_PROJECT"
- name_filter='^cc-gwp-'
+ name_filter="^${name_prefix}-"
if [[ -n "$run_id" ]]; then
- name_filter="^cc-gwp-$(printf '%s' "$run_id" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9-]/-/g' | cut -c1-8)-"
+ name_filter="^${name_prefix}-$(printf '%s' "$run_id" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9-]/-/g' | cut -c1-8)-"
fi
gcloud compute instances list \
@@ -313,7 +380,10 @@ target_workdir() {
}
target_var_args() {
- local root="$1" key_path="$2" public_key
+ local root="$1" key_path="$2" target="$3" public_key provider template
+
+ provider="$(target_provider "$target")"
+ template="$(target_template "$target")"
if [[ -f "${key_path}.pub" ]]; then
public_key="$(cat "${key_path}.pub")"
@@ -322,6 +392,12 @@ target_var_args() {
fi
printf '%s\0%s\0' "-var" "ssh_public_key=${public_key}"
+ if grep -q 'variable "cloud_provider"' "$root/variables.tf"; then
+ printf '%s\0%s\0' "-var" "cloud_provider=${provider}"
+ fi
+ if grep -q 'variable "template"' "$root/variables.tf"; then
+ printf '%s\0%s\0' "-var" "template=${template}"
+ fi
if grep -q 'variable "cloud_compose_source_ref"' "$root/variables.tf"; then
printf '%s\0%s\0' "-var" "cloud_compose_source_ref=${CLOUD_COMPOSE_SOURCE_REF:-${GITHUB_SHA:-main}}"
fi
@@ -563,7 +639,7 @@ run_target() (
chmod 0700 "$home_dir/.ssh"
ensure_key "$key_path"
- mapfile -d '' -t var_args < <(target_var_args "$root" "$key_path")
+ mapfile -d '' -t var_args < <(target_var_args "$root" "$key_path" "$target")
auto_args=()
if [[ -n "${GITHUB_ACTIONS:-}" || "${CLOUD_COMPOSE_SMOKE_AUTO_APPROVE:-}" == "true" ]]; then
@@ -571,6 +647,7 @@ run_target() (
fi
cleanup_started=false
+ # shellcheck disable=SC2317
cleanup() {
local status=$?
local destroy_status destroy_timeout cleanup_status
@@ -653,7 +730,7 @@ destroy_target() (
workdir="$(target_workdir "$target")"
key_path="$workdir/id_ed25519"
- mapfile -d '' -t var_args < <(target_var_args "$root" "$key_path")
+ mapfile -d '' -t var_args < <(target_var_args "$root" "$key_path" "$target")
auto_args=()
if [[ -n "${GITHUB_ACTIONS:-}" || "${CLOUD_COMPOSE_SMOKE_AUTO_APPROVE:-}" == "true" ]]; then
@@ -694,6 +771,8 @@ destroy_target() (
)
main() {
+ local target provider
+
if [[ "$#" -ne 1 ]]; then
usage >&2
exit 2
@@ -701,57 +780,52 @@ main() {
case "$1" in
sweep)
- require_cmd jq
- require_cmd curl
- target_env digitalocean-isle
- provider_tag_cleanup digitalocean-isle "${CLOUD_COMPOSE_SMOKE_RUN_ID:-}"
- target_env linode-wp
- provider_tag_cleanup linode-wp "${CLOUD_COMPOSE_SMOKE_RUN_ID:-}"
- require_cmd gcloud
- target_env gcp-wp
- provider_tag_cleanup gcp-wp "${CLOUD_COMPOSE_SMOKE_RUN_ID:-}"
- exit 0
- ;;
- sweep-digitalocean-isle)
- require_cmd jq
- require_cmd curl
- target_env digitalocean-isle
- provider_tag_cleanup digitalocean-isle "${CLOUD_COMPOSE_SMOKE_RUN_ID:-}"
+ for target in $(default_targets); do
+ provider="$(target_provider "$target")"
+ require_cmd jq
+ case "$provider" in
+ digitalocean | linode)
+ require_cmd curl
+ ;;
+ gcp)
+ require_cmd gcloud
+ ;;
+ esac
+ target_env "$target"
+ provider_tag_cleanup "$target" "${CLOUD_COMPOSE_SMOKE_RUN_ID:-}"
+ done
exit 0
;;
- sweep-linode-wp)
+ sweep-*)
+ target="${1#sweep-}"
+ provider="$(target_provider "$target")"
require_cmd jq
- require_cmd curl
- target_env linode-wp
- provider_tag_cleanup linode-wp "${CLOUD_COMPOSE_SMOKE_RUN_ID:-}"
- exit 0
- ;;
- sweep-gcp-wp)
- require_cmd jq
- require_cmd gcloud
- target_env gcp-wp
- provider_tag_cleanup gcp-wp "${CLOUD_COMPOSE_SMOKE_RUN_ID:-}"
- exit 0
- ;;
- destroy-digitalocean-isle)
- require_cmd jq
- require_cmd curl
- require_cmd terraform
- destroy_target digitalocean-isle
- exit 0
- ;;
- destroy-linode-wp)
- require_cmd jq
- require_cmd curl
- require_cmd terraform
- destroy_target linode-wp
+ case "$provider" in
+ digitalocean | linode)
+ require_cmd curl
+ ;;
+ gcp)
+ require_cmd gcloud
+ ;;
+ esac
+ target_env "$target"
+ provider_tag_cleanup "$target" "${CLOUD_COMPOSE_SMOKE_RUN_ID:-}"
exit 0
;;
- destroy-gcp-wp)
+ destroy-*)
+ target="${1#destroy-}"
+ provider="$(target_provider "$target")"
require_cmd jq
- require_cmd gcloud
require_cmd terraform
- destroy_target gcp-wp
+ case "$provider" in
+ digitalocean | linode)
+ require_cmd curl
+ ;;
+ gcp)
+ require_cmd gcloud
+ ;;
+ esac
+ destroy_target "$target"
exit 0
;;
esac
@@ -766,11 +840,12 @@ main() {
case "$1" in
all)
- run_target digitalocean-isle
- run_target linode-wp
- run_target gcp-wp
+ for target in $(default_targets); do
+ run_target "$target"
+ done
;;
- digitalocean-isle|linode-wp|gcp-wp)
+ digitalocean-* | linode-* | gcp-*)
+ target_template "$1" >/dev/null
run_target "$1"
;;
*)
diff --git a/docs/examples.md b/docs/examples.md
index 4849678..3167394 100644
--- a/docs/examples.md
+++ b/docs/examples.md
@@ -5,24 +5,48 @@ compose app shapes.
## Single app examples
-- `examples/ojs` deploys OJS production and staging environments.
-- `examples/wp` deploys a WordPress compose project with `sitectl-wp`.
-- `examples/drupal` deploys a Drupal compose project with `sitectl-drupal`.
-- `examples/isle` deploys an ISLE compose project with `sitectl-isle`.
+- `examples/app` deploys any supported template by setting `template`.
+- `examples/archivesspace` deploys ArchivesSpace.
+- `examples/ojs` deploys OJS.
+- `examples/isle` deploys ISLE.
+- `examples/drupal` deploys Drupal.
+- `examples/wp` deploys WordPress.
+- `examples/omeka-s` deploys Omeka S.
+- `examples/omeka-classic` deploys Omeka Classic.
- `examples/digitalocean` deploys WordPress on DigitalOcean.
- `examples/linode` deploys Drupal on Linode.
-Each single-app example passes a provider object and a runtime object:
+The root module knows the default compose repo, `sitectl` plugin, and package
+set for each template. A minimal caller supplies the provider and template:
+
+```hcl
+module "app" {
+ source = "../.."
+
+ name = "cc-wp"
+ cloud_provider = "digitalocean"
+ template = "wp"
+ digitalocean = {
+ ssh = {
+ cloud_compose_keys = var.operator_ssh_keys
+ }
+ }
+}
+```
+
+Use `runtime` only for overrides such as branch, ingress, Vault Agent, or
+healthcheck settings:
```hcl
runtime = {
compose = {
- repo = "https://github.com/libops/wp.git"
branch = "main"
- }
- sitectl = {
- packages = ["sitectl", "sitectl-wp"]
- plugin = "wp"
+ ingress = {
+ letsencrypt = true
+ bot_mitigation = true
+ domain = "example.org"
+ acme_email = "ops@example.org"
+ }
}
}
```
@@ -32,7 +56,6 @@ runtime = {
`examples/binpack` shows how several compose projects can share one VM:
```hcl
-compose_projects = {
runtime = {
compose = {
primary = "wp"
diff --git a/docs/non-gcp-providers.md b/docs/non-gcp-providers.md
index decf9a9..00a5b16 100644
--- a/docs/non-gcp-providers.md
+++ b/docs/non-gcp-providers.md
@@ -39,37 +39,49 @@ the auth method through `vault_agent_additional_config` or a rootfs overlay.
## DigitalOcean
Use `DIGITALOCEAN_TOKEN` or an explicit DigitalOcean provider configuration in
-the calling stack.
+the calling stack. Prefer the root module contract so the app template selects
+the compose repo, `sitectl` plugin, and plugin package defaults:
```hcl
module "wp" {
- source = "./modules/digitalocean"
-
- name = "cc-wp"
- region = "tor1"
- ssh_keys = var.digitalocean_ssh_keys
- cloud_compose_ssh_keys = var.operator_ssh_keys
- docker_compose_repo = "https://github.com/libops/wp.git"
- sitectl_packages = ["sitectl", "sitectl-wp"]
- sitectl_plugin = "wp"
+ source = "../.."
+
+ name = "cc-wp"
+ cloud_provider = "digitalocean"
+ template = "wp"
+ digitalocean = {
+ region = "tor1"
+ ssh = {
+ cloud_compose_keys = var.operator_ssh_keys
+ }
+ }
}
```
## Linode
Use `LINODE_TOKEN` or an explicit Linode provider configuration in the calling
-stack.
+stack. Linode metadata is tighter than DigitalOcean, so CI and examples can pass
+`rootfs_archive_url` when the embedded cloud-init payload would be too large:
```hcl
module "drupal" {
- source = "./modules/linode"
-
- name = "cc-drupal"
- region = "us-east"
- authorized_keys = var.operator_ssh_keys
- cloud_compose_ssh_keys = var.operator_ssh_keys
- docker_compose_repo = "https://github.com/libops/drupal.git"
- sitectl_packages = ["sitectl", "sitectl-drupal"]
- sitectl_plugin = "drupal"
+ source = "../.."
+
+ name = "cc-drupal"
+ cloud_provider = "linode"
+ template = "drupal"
+ linode = {
+ region = "us-east"
+ instance = {
+ authorized_keys = var.operator_ssh_keys
+ }
+ ssh = {
+ cloud_compose_keys = var.operator_ssh_keys
+ }
+ }
+ runtime = {
+ rootfs_archive_url = "https://github.com/libops/cloud-compose/archive/main.tar.gz"
+ }
}
```
diff --git a/examples/app/main.tf b/examples/app/main.tf
new file mode 100644
index 0000000..f1e3b86
--- /dev/null
+++ b/examples/app/main.tf
@@ -0,0 +1,39 @@
+terraform {
+ required_version = ">= 1.2.4"
+}
+
+module "app" {
+ source = "../.."
+
+ name = var.name
+ cloud_provider = var.cloud_provider
+ template = var.template
+ gcp = var.gcp
+ digitalocean = var.digitalocean
+ linode = var.linode
+ runtime = var.runtime
+}
+
+output "instance" {
+ value = module.app.instance
+}
+
+output "external_ip" {
+ value = module.app.external_ip
+}
+
+output "internal_ip" {
+ value = module.app.internal_ip
+}
+
+output "volumes" {
+ value = module.app.volumes
+}
+
+output "primary_compose_project" {
+ value = module.app.primary_compose_project
+}
+
+output "compose_projects" {
+ value = module.app.compose_projects
+}
diff --git a/examples/app/variables.tf b/examples/app/variables.tf
new file mode 100644
index 0000000..38e54ce
--- /dev/null
+++ b/examples/app/variables.tf
@@ -0,0 +1,41 @@
+variable "name" {
+ type = string
+ default = "cloud-compose-app"
+ description = "Deployment name."
+}
+
+variable "cloud_provider" {
+ type = string
+ default = "digitalocean"
+ description = "Cloud provider to deploy to: gcp, digitalocean, or linode."
+}
+
+variable "template" {
+ type = string
+ default = "wp"
+ description = "Compose template preset: archivesspace, ojs, isle, drupal, wp, omeka-s, or omeka-classic."
+}
+
+variable "gcp" {
+ type = any
+ default = {}
+ description = "GCP provider settings passed to the root module."
+}
+
+variable "digitalocean" {
+ type = any
+ default = {}
+ description = "DigitalOcean provider settings passed to the root module."
+}
+
+variable "linode" {
+ type = any
+ default = {}
+ description = "Linode provider settings passed to the root module."
+}
+
+variable "runtime" {
+ type = any
+ default = {}
+ description = "Provider-neutral runtime settings passed to the root module."
+}
diff --git a/examples/archivesspace/main.tf b/examples/archivesspace/main.tf
new file mode 100644
index 0000000..e4641b9
--- /dev/null
+++ b/examples/archivesspace/main.tf
@@ -0,0 +1,27 @@
+terraform {
+ required_version = ">= 1.2.4"
+}
+
+module "archivesspace" {
+ source = "../app"
+
+ name = var.name
+ cloud_provider = var.cloud_provider
+ template = "archivesspace"
+ gcp = var.gcp
+ digitalocean = var.digitalocean
+ linode = var.linode
+ runtime = var.runtime
+}
+
+output "instance" {
+ value = module.archivesspace.instance
+}
+
+output "external_ip" {
+ value = module.archivesspace.external_ip
+}
+
+output "primary_compose_project" {
+ value = module.archivesspace.primary_compose_project
+}
diff --git a/examples/archivesspace/variables.tf b/examples/archivesspace/variables.tf
new file mode 100644
index 0000000..377694f
--- /dev/null
+++ b/examples/archivesspace/variables.tf
@@ -0,0 +1,35 @@
+variable "name" {
+ type = string
+ default = "archivesspace-example"
+ description = "Deployment name."
+}
+
+variable "cloud_provider" {
+ type = string
+ default = "digitalocean"
+ description = "Cloud provider to deploy to: gcp, digitalocean, or linode."
+}
+
+variable "gcp" {
+ type = any
+ default = {}
+ description = "GCP provider settings passed to the app example."
+}
+
+variable "digitalocean" {
+ type = any
+ default = {}
+ description = "DigitalOcean provider settings passed to the app example."
+}
+
+variable "linode" {
+ type = any
+ default = {}
+ description = "Linode provider settings passed to the app example."
+}
+
+variable "runtime" {
+ type = any
+ default = {}
+ description = "Provider-neutral runtime settings passed to the app example."
+}
diff --git a/examples/digitalocean/main.tf b/examples/digitalocean/main.tf
index 06c5619..5891cc1 100644
--- a/examples/digitalocean/main.tf
+++ b/examples/digitalocean/main.tf
@@ -3,9 +3,11 @@ terraform {
}
module "wp" {
- source = "../../modules/digitalocean"
+ source = "../.."
- name = var.name
+ name = var.name
+ cloud_provider = "digitalocean"
+ template = "wp"
digitalocean = {
region = var.region
droplet = {
@@ -18,14 +20,9 @@ module "wp" {
}
runtime = {
compose = {
- repo = var.docker_compose_repo
branch = var.docker_compose_branch
ingress_port = var.ingress_port
}
- sitectl = {
- packages = ["sitectl", "sitectl-wp"]
- plugin = "wp"
- }
}
}
diff --git a/examples/digitalocean/variables.tf b/examples/digitalocean/variables.tf
index 4e99c03..a0a440c 100644
--- a/examples/digitalocean/variables.tf
+++ b/examples/digitalocean/variables.tf
@@ -30,8 +30,8 @@ variable "cloud_compose_ssh_keys" {
variable "docker_compose_repo" {
type = string
- default = "https://github.com/libops/wp.git"
- description = "Compose project repository."
+ default = ""
+ description = "Optional compose project repository override. Empty uses the selected template default."
}
variable "docker_compose_branch" {
diff --git a/examples/drupal/main.tf b/examples/drupal/main.tf
index 6edd34a..7bf79c6 100644
--- a/examples/drupal/main.tf
+++ b/examples/drupal/main.tf
@@ -3,27 +3,25 @@ terraform {
}
module "drupal" {
- source = "../.."
+ source = "../app"
- name = var.name
- gcp = {
- project_id = var.project_id
- project_number = var.project_number
- }
- runtime = {
- compose = {
- repo = var.docker_compose_repo
- branch = var.docker_compose_branch
- ingress_port = var.ingress_port
- }
- sitectl = {
- packages = ["sitectl", "sitectl-drupal"]
- plugin = "drupal"
- }
- vault = {
- addr = var.vault_addr
- role = var.vault_role
- agent_enabled = var.vault_agent_enabled
- }
- }
+ name = var.name
+ cloud_provider = var.cloud_provider
+ template = "drupal"
+ gcp = var.gcp
+ digitalocean = var.digitalocean
+ linode = var.linode
+ runtime = var.runtime
+}
+
+output "instance" {
+ value = module.drupal.instance
+}
+
+output "external_ip" {
+ value = module.drupal.external_ip
+}
+
+output "primary_compose_project" {
+ value = module.drupal.primary_compose_project
}
diff --git a/examples/drupal/variables.tf b/examples/drupal/variables.tf
index 1aab0c0..934e263 100644
--- a/examples/drupal/variables.tf
+++ b/examples/drupal/variables.tf
@@ -1,42 +1,35 @@
variable "name" {
- type = string
- default = "drupal-example"
+ type = string
+ default = "drupal-example"
+ description = "Deployment name."
}
-variable "project_id" {
- type = string
+variable "cloud_provider" {
+ type = string
+ default = "digitalocean"
+ description = "Cloud provider to deploy to: gcp, digitalocean, or linode."
}
-variable "project_number" {
- type = string
+variable "gcp" {
+ type = any
+ default = {}
+ description = "GCP provider settings passed to the app example."
}
-variable "docker_compose_repo" {
- type = string
- default = "https://github.com/libops/drupal.git"
+variable "digitalocean" {
+ type = any
+ default = {}
+ description = "DigitalOcean provider settings passed to the app example."
}
-variable "docker_compose_branch" {
- type = string
- default = "main"
+variable "linode" {
+ type = any
+ default = {}
+ description = "Linode provider settings passed to the app example."
}
-variable "ingress_port" {
- type = number
- default = 8080
-}
-
-variable "vault_addr" {
- type = string
- default = ""
-}
-
-variable "vault_role" {
- type = string
- default = ""
-}
-
-variable "vault_agent_enabled" {
- type = bool
- default = false
+variable "runtime" {
+ type = any
+ default = {}
+ description = "Provider-neutral runtime settings passed to the app example."
}
diff --git a/examples/isle/main.tf b/examples/isle/main.tf
index 0e74786..a1caa37 100644
--- a/examples/isle/main.tf
+++ b/examples/isle/main.tf
@@ -3,33 +3,25 @@ terraform {
}
module "isle" {
- source = "../.."
+ source = "../app"
- name = var.name
- gcp = {
- project_id = var.project_id
- project_number = var.project_number
- }
- runtime = {
- compose = {
- repo = var.docker_compose_repo
- branch = var.docker_compose_branch
- ingress_port = var.ingress_port
- ingress = {
- letsencrypt = var.enable_letsencrypt
- bot_mitigation = var.enable_bot_mitigation
- domain = var.domain
- acme_email = var.acme_email
- }
- }
- sitectl = {
- packages = ["sitectl", "sitectl-isle"]
- plugin = "isle"
- }
- vault = {
- addr = var.vault_addr
- role = var.vault_role
- agent_enabled = var.vault_agent_enabled
- }
- }
+ name = var.name
+ cloud_provider = var.cloud_provider
+ template = "isle"
+ gcp = var.gcp
+ digitalocean = var.digitalocean
+ linode = var.linode
+ runtime = var.runtime
+}
+
+output "instance" {
+ value = module.isle.instance
+}
+
+output "external_ip" {
+ value = module.isle.external_ip
+}
+
+output "primary_compose_project" {
+ value = module.isle.primary_compose_project
}
diff --git a/examples/isle/variables.tf b/examples/isle/variables.tf
index c298f51..279be6c 100644
--- a/examples/isle/variables.tf
+++ b/examples/isle/variables.tf
@@ -1,62 +1,35 @@
variable "name" {
- type = string
- default = "isle-example"
+ type = string
+ default = "isle-example"
+ description = "Deployment name."
}
-variable "project_id" {
- type = string
+variable "cloud_provider" {
+ type = string
+ default = "digitalocean"
+ description = "Cloud provider to deploy to: gcp, digitalocean, or linode."
}
-variable "project_number" {
- type = string
+variable "gcp" {
+ type = any
+ default = {}
+ description = "GCP provider settings passed to the app example."
}
-variable "docker_compose_repo" {
- type = string
- default = "https://github.com/libops/isle"
+variable "digitalocean" {
+ type = any
+ default = {}
+ description = "DigitalOcean provider settings passed to the app example."
}
-variable "docker_compose_branch" {
- type = string
- default = "main"
+variable "linode" {
+ type = any
+ default = {}
+ description = "Linode provider settings passed to the app example."
}
-variable "ingress_port" {
- type = number
- default = 8080
-}
-
-variable "domain" {
- type = string
- default = ""
-}
-
-variable "acme_email" {
- type = string
- default = ""
-}
-
-variable "enable_letsencrypt" {
- type = bool
- default = false
-}
-
-variable "enable_bot_mitigation" {
- type = bool
- default = false
-}
-
-variable "vault_addr" {
- type = string
- default = ""
-}
-
-variable "vault_role" {
- type = string
- default = ""
-}
-
-variable "vault_agent_enabled" {
- type = bool
- default = false
+variable "runtime" {
+ type = any
+ default = {}
+ description = "Provider-neutral runtime settings passed to the app example."
}
diff --git a/examples/linode/main.tf b/examples/linode/main.tf
index de07fea..4b458d9 100644
--- a/examples/linode/main.tf
+++ b/examples/linode/main.tf
@@ -3,9 +3,11 @@ terraform {
}
module "drupal" {
- source = "../../modules/linode"
+ source = "../.."
- name = var.name
+ name = var.name
+ cloud_provider = "linode"
+ template = "drupal"
linode = {
region = var.region
instance = {
@@ -21,14 +23,9 @@ module "drupal" {
runtime = {
rootfs_archive_url = "https://github.com/libops/cloud-compose/archive/${var.cloud_compose_source_ref}.tar.gz"
compose = {
- repo = var.docker_compose_repo
branch = var.docker_compose_branch
ingress_port = var.ingress_port
}
- sitectl = {
- packages = ["sitectl", "sitectl-drupal"]
- plugin = "drupal"
- }
}
}
diff --git a/examples/linode/variables.tf b/examples/linode/variables.tf
index ddba579..fc512c2 100644
--- a/examples/linode/variables.tf
+++ b/examples/linode/variables.tf
@@ -49,8 +49,8 @@ variable "cloud_compose_source_ref" {
variable "docker_compose_repo" {
type = string
- default = "https://github.com/libops/drupal.git"
- description = "Compose project repository."
+ default = ""
+ description = "Optional compose project repository override. Empty uses the selected template default."
}
variable "docker_compose_branch" {
diff --git a/examples/ojs/README.md b/examples/ojs/README.md
deleted file mode 100644
index 6eeb0f8..0000000
--- a/examples/ojs/README.md
+++ /dev/null
@@ -1,20 +0,0 @@
-# OJS
-
-Deploy OJS to Google Cloud
-
-## Usage
-
-Create the production VM
-
-```
-terraform init
-terraform apply -target=module.production
-```
-
-The staging VM then relies on a snapshot of the public files docker volume. This is to allow staging to mirror production.
-
-So need wait until snapshot schedule executes (~1h) OR get a snapshot of the production docker volume disk immediately. then the rest of the terraform runs can just execute as normal
-
-```
-terraform apply
-```
diff --git a/examples/ojs/main.tf b/examples/ojs/main.tf
index 138250b..5d5c18d 100644
--- a/examples/ojs/main.tf
+++ b/examples/ojs/main.tf
@@ -1,73 +1,27 @@
-resource "random_shuffle" "zone" {
- input = var.region == "us-central1" ? ["a", "b", "c", "f"] : ["a", "b", "c"]
- result_count = 1
+terraform {
+ required_version = ">= 1.2.4"
}
-module "production" {
- source = "../.."
+module "ojs" {
+ source = "../app"
- name = "ojs-production"
- gcp = {
- project_id = var.project_id
- project_number = var.project_number
- region = var.region
- zone = format("%s-%s", var.region, random_shuffle.zone.result[0])
- instance = {
- production = true
- }
- snapshots = {
- enabled = true
- }
- network = {
- power_button_allowed_ips = var.allowed_ips
- }
- }
- runtime = {
- compose = {
- repo = var.docker_compose_repo
- branch = var.docker_compose_branch
- init = var.docker_compose_init
- }
- sitectl = {
- packages = ["sitectl", "sitectl-ojs"]
- plugin = "ojs"
- }
- }
+ name = var.name
+ cloud_provider = var.cloud_provider
+ template = "ojs"
+ gcp = var.gcp
+ digitalocean = var.digitalocean
+ linode = var.linode
+ runtime = var.runtime
}
-module "staging" {
- source = "../.."
+output "instance" {
+ value = module.ojs.instance
+}
+
+output "external_ip" {
+ value = module.ojs.external_ip
+}
- name = "ojs-staging"
- gcp = {
- project_id = var.project_id
- project_number = var.project_number
- region = var.region
- zone = format("%s-%s", var.region, random_shuffle.zone.result[0])
- disks = {
- docker_volumes_size_gb = 20
- }
- network = {
- power_button_allowed_ips = var.allowed_ips
- }
- overlay = {
- source_instance = "ojs-production"
- volume_names = [
- "compose_ojs-public",
- "compose_ojs-files"
- ]
- }
- }
- runtime = {
- compose = {
- repo = var.docker_compose_repo
- branch = var.docker_compose_branch
- init = var.docker_compose_init
- }
- sitectl = {
- packages = ["sitectl", "sitectl-ojs"]
- plugin = "ojs"
- environment = "staging"
- }
- }
+output "primary_compose_project" {
+ value = module.ojs.primary_compose_project
}
diff --git a/examples/ojs/terraform.tfvars b/examples/ojs/terraform.tfvars
deleted file mode 100644
index 43b2002..0000000
--- a/examples/ojs/terraform.tfvars
+++ /dev/null
@@ -1,4 +0,0 @@
-docker_compose_repo = "https://github.com/libops/ojs"
-docker_compose_init = [
- "docker compose run init"
-]
diff --git a/examples/ojs/variables.tf b/examples/ojs/variables.tf
index 7417684..fb084b2 100644
--- a/examples/ojs/variables.tf
+++ b/examples/ojs/variables.tf
@@ -1,38 +1,35 @@
-variable "project_id" {
- description = "The GCP project ID"
+variable "name" {
type = string
+ default = "ojs-example"
+ description = "Deployment name."
}
-variable "project_number" {
+variable "cloud_provider" {
type = string
- description = "The GCP project number"
+ default = "digitalocean"
+ description = "Cloud provider to deploy to: gcp, digitalocean, or linode."
}
-variable "region" {
- description = "GCP region for resources"
- type = string
- default = "us-central1"
+variable "gcp" {
+ type = any
+ default = {}
+ description = "GCP provider settings passed to the app example."
}
-variable "docker_compose_repo" {
- type = string
- description = "git repo to checkout that contains a docker compose project"
-}
-
-variable "docker_compose_branch" {
- type = string
- default = "main"
- description = "git branch to checkout for var.docker_compose_repo"
+variable "digitalocean" {
+ type = any
+ default = {}
+ description = "DigitalOcean provider settings passed to the app example."
}
-variable "docker_compose_init" {
- type = list(string)
- default = []
- description = "After cloning the docker compose git repo, any initialization that needs to happen before the docker compose project can start"
+variable "linode" {
+ type = any
+ default = {}
+ description = "Linode provider settings passed to the app example."
}
-variable "allowed_ips" {
- type = list(string)
- default = []
- description = "CIDR IP Addresses allowed to turn on this site's GCP instance"
+variable "runtime" {
+ type = any
+ default = {}
+ description = "Provider-neutral runtime settings passed to the app example."
}
diff --git a/examples/omeka-classic/main.tf b/examples/omeka-classic/main.tf
new file mode 100644
index 0000000..a48af8f
--- /dev/null
+++ b/examples/omeka-classic/main.tf
@@ -0,0 +1,27 @@
+terraform {
+ required_version = ">= 1.2.4"
+}
+
+module "omeka_classic" {
+ source = "../app"
+
+ name = var.name
+ cloud_provider = var.cloud_provider
+ template = "omeka-classic"
+ gcp = var.gcp
+ digitalocean = var.digitalocean
+ linode = var.linode
+ runtime = var.runtime
+}
+
+output "instance" {
+ value = module.omeka_classic.instance
+}
+
+output "external_ip" {
+ value = module.omeka_classic.external_ip
+}
+
+output "primary_compose_project" {
+ value = module.omeka_classic.primary_compose_project
+}
diff --git a/examples/omeka-classic/variables.tf b/examples/omeka-classic/variables.tf
new file mode 100644
index 0000000..aac4363
--- /dev/null
+++ b/examples/omeka-classic/variables.tf
@@ -0,0 +1,35 @@
+variable "name" {
+ type = string
+ default = "omeka-classic-example"
+ description = "Deployment name."
+}
+
+variable "cloud_provider" {
+ type = string
+ default = "digitalocean"
+ description = "Cloud provider to deploy to: gcp, digitalocean, or linode."
+}
+
+variable "gcp" {
+ type = any
+ default = {}
+ description = "GCP provider settings passed to the app example."
+}
+
+variable "digitalocean" {
+ type = any
+ default = {}
+ description = "DigitalOcean provider settings passed to the app example."
+}
+
+variable "linode" {
+ type = any
+ default = {}
+ description = "Linode provider settings passed to the app example."
+}
+
+variable "runtime" {
+ type = any
+ default = {}
+ description = "Provider-neutral runtime settings passed to the app example."
+}
diff --git a/examples/omeka-s/main.tf b/examples/omeka-s/main.tf
new file mode 100644
index 0000000..bc24741
--- /dev/null
+++ b/examples/omeka-s/main.tf
@@ -0,0 +1,27 @@
+terraform {
+ required_version = ">= 1.2.4"
+}
+
+module "omeka_s" {
+ source = "../app"
+
+ name = var.name
+ cloud_provider = var.cloud_provider
+ template = "omeka-s"
+ gcp = var.gcp
+ digitalocean = var.digitalocean
+ linode = var.linode
+ runtime = var.runtime
+}
+
+output "instance" {
+ value = module.omeka_s.instance
+}
+
+output "external_ip" {
+ value = module.omeka_s.external_ip
+}
+
+output "primary_compose_project" {
+ value = module.omeka_s.primary_compose_project
+}
diff --git a/examples/omeka-s/variables.tf b/examples/omeka-s/variables.tf
new file mode 100644
index 0000000..f304c5b
--- /dev/null
+++ b/examples/omeka-s/variables.tf
@@ -0,0 +1,35 @@
+variable "name" {
+ type = string
+ default = "omeka-s-example"
+ description = "Deployment name."
+}
+
+variable "cloud_provider" {
+ type = string
+ default = "digitalocean"
+ description = "Cloud provider to deploy to: gcp, digitalocean, or linode."
+}
+
+variable "gcp" {
+ type = any
+ default = {}
+ description = "GCP provider settings passed to the app example."
+}
+
+variable "digitalocean" {
+ type = any
+ default = {}
+ description = "DigitalOcean provider settings passed to the app example."
+}
+
+variable "linode" {
+ type = any
+ default = {}
+ description = "Linode provider settings passed to the app example."
+}
+
+variable "runtime" {
+ type = any
+ default = {}
+ description = "Provider-neutral runtime settings passed to the app example."
+}
diff --git a/examples/wp/main.tf b/examples/wp/main.tf
index 16fbbc4..75260c4 100644
--- a/examples/wp/main.tf
+++ b/examples/wp/main.tf
@@ -3,27 +3,25 @@ terraform {
}
module "wp" {
- source = "../.."
+ source = "../app"
- name = var.name
- gcp = {
- project_id = var.project_id
- project_number = var.project_number
- }
- runtime = {
- compose = {
- repo = var.docker_compose_repo
- branch = var.docker_compose_branch
- ingress_port = var.ingress_port
- }
- sitectl = {
- packages = ["sitectl", "sitectl-wp"]
- plugin = "wp"
- }
- vault = {
- addr = var.vault_addr
- role = var.vault_role
- agent_enabled = var.vault_agent_enabled
- }
- }
+ name = var.name
+ cloud_provider = var.cloud_provider
+ template = "wp"
+ gcp = var.gcp
+ digitalocean = var.digitalocean
+ linode = var.linode
+ runtime = var.runtime
+}
+
+output "instance" {
+ value = module.wp.instance
+}
+
+output "external_ip" {
+ value = module.wp.external_ip
+}
+
+output "primary_compose_project" {
+ value = module.wp.primary_compose_project
}
diff --git a/examples/wp/variables.tf b/examples/wp/variables.tf
index bca92f0..7bbc626 100644
--- a/examples/wp/variables.tf
+++ b/examples/wp/variables.tf
@@ -1,42 +1,35 @@
variable "name" {
- type = string
- default = "wp-example"
+ type = string
+ default = "wp-example"
+ description = "Deployment name."
}
-variable "project_id" {
- type = string
+variable "cloud_provider" {
+ type = string
+ default = "digitalocean"
+ description = "Cloud provider to deploy to: gcp, digitalocean, or linode."
}
-variable "project_number" {
- type = string
+variable "gcp" {
+ type = any
+ default = {}
+ description = "GCP provider settings passed to the app example."
}
-variable "docker_compose_repo" {
- type = string
- default = "https://github.com/libops/wp.git"
+variable "digitalocean" {
+ type = any
+ default = {}
+ description = "DigitalOcean provider settings passed to the app example."
}
-variable "docker_compose_branch" {
- type = string
- default = "main"
+variable "linode" {
+ type = any
+ default = {}
+ description = "Linode provider settings passed to the app example."
}
-variable "ingress_port" {
- type = number
- default = 8080
-}
-
-variable "vault_addr" {
- type = string
- default = ""
-}
-
-variable "vault_role" {
- type = string
- default = ""
-}
-
-variable "vault_agent_enabled" {
- type = bool
- default = false
+variable "runtime" {
+ type = any
+ default = {}
+ description = "Provider-neutral runtime settings passed to the app example."
}
diff --git a/main.tf b/main.tf
index d0dd429..ae13795 100644
--- a/main.tf
+++ b/main.tf
@@ -3,11 +3,96 @@ terraform {
}
locals {
- compose = var.runtime.compose
- sitectl = var.runtime.sitectl
- docker = var.runtime.docker
- managed = var.runtime.managed_runtime
- vault = var.runtime.vault
+ cloud_provider = lower(trimspace(var.cloud_provider))
+ template_name = lower(trimspace(var.template))
+
+ app_templates = {
+ archivesspace = {
+ repo = "https://github.com/libops/archivesspace.git"
+ branch = "main"
+ plugin = "archivesspace"
+ packages = ["sitectl", "sitectl-archivesspace"]
+ }
+ ojs = {
+ repo = "https://github.com/libops/ojs.git"
+ branch = "main"
+ plugin = "ojs"
+ packages = ["sitectl", "sitectl-ojs"]
+ }
+ isle = {
+ repo = "https://github.com/libops/isle"
+ branch = "main"
+ plugin = "isle"
+ packages = ["sitectl", "sitectl-drupal", "sitectl-isle"]
+ }
+ drupal = {
+ repo = "https://github.com/libops/drupal.git"
+ branch = "main"
+ plugin = "drupal"
+ packages = ["sitectl", "sitectl-drupal"]
+ }
+ wp = {
+ repo = "https://github.com/libops/wp.git"
+ branch = "main"
+ plugin = "wp"
+ packages = ["sitectl", "sitectl-wp"]
+ }
+ "omeka-s" = {
+ repo = "https://github.com/libops/omeka-s.git"
+ branch = "main"
+ plugin = "omeka-s"
+ packages = ["sitectl", "sitectl-omeka-s"]
+ }
+ "omeka-classic" = {
+ repo = "https://github.com/libops/omeka-classic.git"
+ branch = "main"
+ plugin = "omeka-classic"
+ packages = ["sitectl", "sitectl-omeka-classic"]
+ }
+ }
+ empty_template = {
+ repo = ""
+ branch = "main"
+ plugin = "core"
+ packages = ["sitectl"]
+ }
+ template = local.template_name == "" ? local.empty_template : try(local.app_templates[local.template_name], local.empty_template)
+
+ input_compose = var.runtime.compose
+ input_sitectl = var.runtime.sitectl
+
+ runtime = merge(var.runtime, {
+ compose = merge(local.input_compose, {
+ repo = (
+ trimspace(local.input_compose.repo) != ""
+ ? local.input_compose.repo
+ : local.template.repo
+ )
+ branch = (
+ trimspace(local.input_compose.branch) != ""
+ ? local.input_compose.branch
+ : local.template.branch
+ )
+ })
+ sitectl = merge(local.input_sitectl, {
+ packages = (
+ local.template_name != "" && local.input_sitectl.packages == ["sitectl"]
+ ? local.template.packages
+ : local.input_sitectl.packages
+ )
+ plugin = (
+ local.template_name != "" && local.input_sitectl.plugin == "core"
+ ? local.template.plugin
+ : local.input_sitectl.plugin
+ )
+ })
+ })
+
+ compose = local.runtime.compose
+ sitectl = local.runtime.sitectl
+ docker = local.runtime.docker
+ managed = local.runtime.managed_runtime
+ vault = local.runtime.vault
gcp_instance = var.gcp.instance
gcp_disks = var.gcp.disks
@@ -19,9 +104,36 @@ locals {
gcp_cloud_init = var.gcp.cloud_init
gcp_power_management = var.gcp.power_management
gcp_rollout = var.gcp.rollout
+
+ linux_runtime = {
+ rootfs = local.runtime.rootfs
+ rootfs_archive_url = local.runtime.rootfs_archive_url
+ rootfs_archive_sha256 = local.runtime.rootfs_archive_sha256
+ compose = local.compose
+ sitectl = local.sitectl
+ docker = local.docker
+ managed_runtime = {
+ enabled = local.managed.enabled
+ internal_services_enabled = local.managed.internal_services_enabled
+ internal_services_auto_update = local.managed.internal_services_auto_update
+ artifacts = local.managed.artifacts
+ }
+ vault = {
+ addr = local.vault.addr
+ namespace = local.vault.namespace
+ role = local.vault.role
+ agent_enabled = local.vault.agent_enabled
+ auth_method = local.vault.auth_method
+ agent_token_path = local.vault.agent_token_path
+ agent_additional_config = local.vault.agent_additional_config
+ agent_templates = local.vault.agent_templates
+ }
+ extra_env = local.runtime.extra_env
+ }
}
module "gcp" {
+ count = local.cloud_provider == "gcp" ? 1 : 0
source = "./modules/gcp"
name = var.name
@@ -84,8 +196,8 @@ module "gcp" {
overlay_source_instance = local.gcp_overlay.source_instance
volume_names = local.gcp_overlay.volume_names
- users = var.runtime.users
- rootfs = var.runtime.rootfs
+ users = local.runtime.users
+ rootfs = local.runtime.rootfs
runcmd = local.gcp_cloud_init.runcmd
initcmd = local.gcp_cloud_init.initcmd
@@ -114,3 +226,21 @@ module "gcp" {
vault_agent_templates = local.vault.agent_templates
vault_agent_additional_config = local.vault.agent_additional_config
}
+
+module "digitalocean" {
+ count = local.cloud_provider == "digitalocean" ? 1 : 0
+ source = "./modules/digitalocean"
+
+ name = var.name
+ digitalocean = var.digitalocean
+ runtime = local.linux_runtime
+}
+
+module "linode" {
+ count = local.cloud_provider == "linode" ? 1 : 0
+ source = "./modules/linode"
+
+ name = var.name
+ linode = var.linode
+ runtime = local.linux_runtime
+}
diff --git a/modules/gcp/main.tf b/modules/gcp/main.tf
index ed0dba3..9bc8ff5 100644
--- a/modules/gcp/main.tf
+++ b/modules/gcp/main.tf
@@ -806,7 +806,7 @@ resource "google_service_account" "ppb" {
module "ppb" {
count = var.power_management_enabled ? 1 : 0
- source = "github.com/libops/terraform-cloudrun-v2?ref=0.5.3"
+ source = "https://github.com/libops/terraform-cloudrun-v2/archive/refs/tags/0.5.3.zip//terraform-cloudrun-v2-0.5.3"
name = var.name
project = var.project_id
diff --git a/outputs.tf b/outputs.tf
index 605bd58..5ea4e55 100644
--- a/outputs.tf
+++ b/outputs.tf
@@ -1,54 +1,103 @@
+output "cloud_provider" {
+ value = local.cloud_provider
+ description = "Selected cloud provider."
+}
+
+output "template" {
+ value = local.template_name
+ description = "Selected compose template preset."
+}
+
output "instance" {
- value = module.gcp.instance
- description = "The Google Compute instance ID, name, zone, data disk, and GSA."
+ value = try(
+ module.gcp[0].instance,
+ module.digitalocean[0].instance,
+ module.linode[0].instance,
+ null,
+ )
+ description = "Selected provider VM instance details."
}
output "instance_id" {
- value = module.gcp.instance_id
- description = "The Google Compute instance ID."
+ value = try(
+ module.gcp[0].instance_id,
+ module.digitalocean[0].instance.id,
+ module.linode[0].instance.id,
+ null,
+ )
+ description = "Selected provider VM instance ID."
}
output "external_ip" {
- value = module.gcp.external_ip
- description = "The Google Compute instance external IPv4 address."
+ value = try(
+ module.gcp[0].external_ip,
+ module.digitalocean[0].instance.ipv4,
+ module.linode[0].instance.public_ipv4,
+ null,
+ )
+ description = "Selected provider VM public IPv4 address."
}
output "internal_ip" {
- value = module.gcp.internal_ip
- description = "The Google Compute instance internal IPv4 address."
+ value = try(
+ module.gcp[0].internal_ip,
+ module.digitalocean[0].instance.private_ip,
+ module.linode[0].instance.private_ip,
+ null,
+ )
+ description = "Selected provider VM private IPv4 address."
+}
+
+output "volumes" {
+ value = try(
+ module.digitalocean[0].volumes,
+ module.linode[0].volumes,
+ null,
+ )
+ description = "Selected provider persistent volume details where available."
}
output "serviceGsa" {
- value = module.gcp.serviceGsa
+ value = try(module.gcp[0].serviceGsa, null)
description = "The Google Service Account internal services run as."
}
output "appGsa" {
- value = module.gcp.appGsa
+ value = try(module.gcp[0].appGsa, null)
description = "The Google Service Account the app can use for app-scoped auth."
}
output "urls" {
- value = module.gcp.urls
+ value = try(module.gcp[0].urls, {})
description = "Cloud Run ingress URLs by region."
}
output "backend" {
- value = module.gcp.backend
+ value = try(module.gcp[0].backend, null)
description = "Backend service ID for attaching Cloud Run ingress to an external HTTPS load balancer."
}
output "rollout" {
- value = module.gcp.rollout
+ value = try(module.gcp[0].rollout, null)
description = "Optional rollout API endpoint details."
}
output "compose_projects" {
- value = module.gcp.compose_projects
+ value = try(
+ module.gcp[0].compose_projects,
+ module.digitalocean[0].compose_projects,
+ module.linode[0].compose_projects,
+ {},
+ )
description = "Normalized compose project manifest."
}
output "primary_compose_project" {
- value = module.gcp.primary_compose_project
+ value = try(
+ module.gcp[0].primary_compose_project,
+ module.digitalocean[0].primary_compose_project,
+ module.linode[0].primary_compose_project,
+ null,
+ )
description = "Normalized primary compose project."
}
diff --git a/rootfs/home/cloud-compose/install-docker-plugins.sh b/rootfs/home/cloud-compose/install-docker-plugins.sh
index b6cd6a5..99f8540 100644
--- a/rootfs/home/cloud-compose/install-docker-plugins.sh
+++ b/rootfs/home/cloud-compose/install-docker-plugins.sh
@@ -36,6 +36,7 @@ install_docker_cli_plugin() {
return 0
fi
+ echo "Installing Docker CLI plugin ${name}"
mkdir -p "$(dirname "$path")"
retry_until_success curl -fsSL "$url" -o "$path"
chmod a+x "$path"
diff --git a/tests/smoke/app/main.tf b/tests/smoke/app/main.tf
new file mode 100644
index 0000000..3740f69
--- /dev/null
+++ b/tests/smoke/app/main.tf
@@ -0,0 +1,187 @@
+terraform {
+ required_version = ">= 1.2.4"
+
+ required_providers {
+ digitalocean = {
+ source = "digitalocean/digitalocean"
+ version = "~> 2.0"
+ }
+ google = {
+ source = "hashicorp/google"
+ version = "~> 7.0"
+ }
+ linode = {
+ source = "linode/linode"
+ version = "~> 4.0"
+ }
+ random = {
+ source = "hashicorp/random"
+ version = "~> 3.7"
+ }
+ }
+}
+
+provider "digitalocean" {}
+
+provider "google" {
+ project = local.project_id
+ region = var.gcp_region
+ zone = var.gcp_zone
+}
+
+provider "linode" {}
+
+data "google_project" "current" {
+ count = local.cloud_provider == "gcp" ? 1 : 0
+ project_id = local.project_id
+}
+
+resource "random_id" "suffix" {
+ byte_length = local.cloud_provider == "gcp" ? 2 : 3
+}
+
+locals {
+ cloud_provider = lower(trimspace(var.cloud_provider))
+ template = lower(trimspace(var.template))
+ target = "${local.cloud_provider}-${local.template}"
+ project_id = trimspace(var.gcp_project_id)
+
+ provider_prefixes = {
+ digitalocean = "do"
+ gcp = "g"
+ linode = "ln"
+ }
+ template_slugs = {
+ archivesspace = "as"
+ ojs = "ojs"
+ isle = "isle"
+ drupal = "dr"
+ wp = "wp"
+ "omeka-s" = "os"
+ "omeka-classic" = "oc"
+ }
+
+ smoke_run_id = substr(replace(lower(var.smoke_run_id), "/[^a-z0-9-]/", "-"), 0, local.cloud_provider == "gcp" ? 8 : 16)
+ name_prefix = "cc-${local.provider_prefixes[local.cloud_provider]}-${local.template_slugs[local.template]}"
+ name_limit = local.cloud_provider == "gcp" ? 21 : 46
+ name = substr(join("-", compact([local.name_prefix, local.smoke_run_id, random_id.suffix.hex])), 0, local.name_limit)
+ run_tag = local.smoke_run_id != "" ? "gha-run-${local.smoke_run_id}" : ""
+ tags = distinct(concat(var.tags, ["cloud-compose-smoke", local.target], local.run_tag != "" ? [local.run_tag] : []))
+
+ ssh_keys = distinct(concat([var.ssh_public_key], var.operator_ssh_public_keys))
+ healthcheck_timeout = trimspace(var.healthcheck_timeout) != "" ? var.healthcheck_timeout : contains(["isle"], local.template) ? "30m" : "20m"
+
+ runtime = {
+ rootfs_archive_url = local.cloud_provider == "linode" ? "https://github.com/libops/cloud-compose/archive/${var.cloud_compose_source_ref}.tar.gz" : ""
+ users = local.cloud_provider == "gcp" ? { cloud-compose = local.ssh_keys } : {}
+ compose = {
+ branch = var.docker_compose_branch
+ ingress_port = var.ingress_port
+ up = [
+ "sitectl compose --context \"$${SITECTL_CONTEXT_NAME}\" up -d --remove-orphans",
+ "sitectl healthcheck --context \"$${SITECTL_CONTEXT_NAME}\" --persist --timeout \"$${SITECTL_HEALTHCHECK_TIMEOUT}\" --interval \"$${SITECTL_HEALTHCHECK_INTERVAL}\""
+ ]
+ }
+ sitectl = {
+ environment = "smoke"
+ healthcheck_timeout = local.healthcheck_timeout
+ healthcheck_interval = var.healthcheck_interval
+ }
+ managed_runtime = {
+ enabled = true
+ internal_services_enabled = false
+ internal_services_auto_update = false
+ }
+ vault = {
+ auth_method = "consumer-managed"
+ }
+ }
+}
+
+module "app" {
+ source = "../../../examples/app"
+
+ name = local.name
+ cloud_provider = local.cloud_provider
+ template = local.template
+ gcp = {
+ project_id = local.project_id
+ project_number = local.cloud_provider == "gcp" ? data.google_project.current[0].number : ""
+ region = var.gcp_region
+ zone = var.gcp_zone
+ instance = {
+ machine_type = var.gcp_machine_type
+ os = var.gcp_os
+ production = false
+ }
+ disks = {
+ type = var.gcp_disk_type
+ docker_volumes_size_gb = var.docker_volumes_volume_size_gb
+ }
+ snapshots = {
+ enabled = false
+ }
+ network = {
+ ssh_ipv4 = var.ssh_source_ranges
+ ssh_ipv6 = []
+ }
+ power_management = {
+ enabled = false
+ }
+ }
+ digitalocean = {
+ region = var.digitalocean_region
+ tags = local.tags
+ droplet = {
+ size = var.digitalocean_size
+ image = var.digitalocean_image
+ monitoring = true
+ ipv6 = true
+ backups = false
+ }
+ ssh = {
+ cloud_compose_keys = local.ssh_keys
+ }
+ volumes = {
+ data_size_gb = var.data_volume_size_gb
+ docker_volumes_size_gb = var.docker_volumes_volume_size_gb
+ }
+ }
+ linode = {
+ region = var.linode_region
+ tags = local.tags
+ instance = {
+ type = var.linode_type
+ image = var.linode_image
+ authorized_keys = local.ssh_keys
+ }
+ ssh = {
+ cloud_compose_keys = local.ssh_keys
+ }
+ volumes = {
+ data_size_gb = var.data_volume_size_gb
+ docker_volumes_size_gb = var.docker_volumes_volume_size_gb
+ }
+ }
+ runtime = local.runtime
+}
+
+output "smoke" {
+ description = "Remote sitectl context details for the smoke test runner."
+ value = {
+ provider = local.cloud_provider
+ app = local.template
+ host = module.app.external_ip
+ ssh_user = "cloud-compose"
+ ssh_port = 22
+ context_name = module.app.primary_compose_project.sitectl_context_name
+ plugin = module.app.primary_compose_project.sitectl_plugin
+ environment = module.app.primary_compose_project.sitectl_environment
+ site = local.name
+ project_name = local.name
+ project_dir = module.app.primary_compose_project.project_dir
+ compose_project_name = module.app.primary_compose_project.compose_project_name
+ healthcheck_timeout = local.healthcheck_timeout
+ healthcheck_interval = var.healthcheck_interval
+ }
+}
diff --git a/tests/smoke/app/variables.tf b/tests/smoke/app/variables.tf
new file mode 100644
index 0000000..882cfd1
--- /dev/null
+++ b/tests/smoke/app/variables.tf
@@ -0,0 +1,171 @@
+variable "cloud_provider" {
+ type = string
+ default = "digitalocean"
+ description = "Cloud provider smoke target."
+
+ validation {
+ condition = contains(["digitalocean", "gcp", "linode"], lower(trimspace(var.cloud_provider)))
+ error_message = "cloud_provider must be digitalocean, gcp, or linode."
+ }
+}
+
+variable "template" {
+ type = string
+ default = "wp"
+ description = "Compose template smoke target."
+
+ validation {
+ condition = contains(["archivesspace", "ojs", "isle", "drupal", "wp", "omeka-s", "omeka-classic"], lower(trimspace(var.template)))
+ error_message = "template must be archivesspace, ojs, isle, drupal, wp, omeka-s, or omeka-classic."
+ }
+}
+
+variable "gcp_project_id" {
+ type = string
+ default = ""
+ description = "Google Cloud project used for disposable smoke-test resources."
+}
+
+variable "gcp_region" {
+ type = string
+ default = "us-east5"
+ description = "Google Cloud region for smoke-test resources."
+}
+
+variable "gcp_zone" {
+ type = string
+ default = "us-east5-b"
+ description = "Google Cloud zone for smoke-test resources."
+}
+
+variable "gcp_machine_type" {
+ type = string
+ default = "e2-medium"
+ description = "Google Compute Engine machine type."
+}
+
+variable "gcp_disk_type" {
+ type = string
+ default = "pd-standard"
+ description = "Google Compute Engine disk type."
+}
+
+variable "gcp_os" {
+ type = string
+ default = "cos-125-19216-220-185"
+ description = "Compute-optimized OS image name."
+}
+
+variable "digitalocean_region" {
+ type = string
+ default = "tor1"
+ description = "DigitalOcean region slug."
+}
+
+variable "digitalocean_size" {
+ type = string
+ default = "s-4vcpu-8gb"
+ description = "DigitalOcean Droplet size slug."
+}
+
+variable "digitalocean_image" {
+ type = string
+ default = "ubuntu-24-04-x64"
+ description = "DigitalOcean Droplet image slug."
+}
+
+variable "linode_region" {
+ type = string
+ default = "us-east"
+ description = "Linode region slug."
+}
+
+variable "linode_type" {
+ type = string
+ default = "g6-standard-2"
+ description = "Linode instance type."
+}
+
+variable "linode_image" {
+ type = string
+ default = "linode/ubuntu22.04"
+ description = "Linode image slug."
+}
+
+variable "ssh_public_key" {
+ type = string
+ description = "Public SSH key authorized for smoke-test access."
+
+ validation {
+ condition = trimspace(var.ssh_public_key) != ""
+ error_message = "ssh_public_key is required."
+ }
+}
+
+variable "operator_ssh_public_keys" {
+ type = list(string)
+ default = [
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOuUgUvvcJyWVZkgLrBGGI9RfcNmQsw32QNftNS5/Iiv jcorall@MacBookPro"
+ ]
+ description = "Additional SSH public keys authorized for operator access during smoke tests."
+}
+
+variable "ssh_source_ranges" {
+ type = list(string)
+ default = ["0.0.0.0/0"]
+ description = "CIDR IPv4 ranges allowed to SSH into the disposable smoke-test VM."
+}
+
+variable "smoke_run_id" {
+ type = string
+ default = ""
+ description = "Optional GitHub Actions run id used to tag and name disposable smoke-test resources."
+}
+
+variable "docker_compose_branch" {
+ type = string
+ default = "main"
+ description = "Compose template branch."
+}
+
+variable "ingress_port" {
+ type = number
+ default = 80
+ description = "Host port exposed by Traefik."
+}
+
+variable "data_volume_size_gb" {
+ type = number
+ default = 10
+ description = "Disposable smoke-test data volume size."
+}
+
+variable "docker_volumes_volume_size_gb" {
+ type = number
+ default = 30
+ description = "Disposable smoke-test Docker volumes volume size."
+}
+
+variable "healthcheck_timeout" {
+ type = string
+ default = ""
+ description = "Timeout passed to sitectl healthcheck. Empty chooses a template-specific default."
+}
+
+variable "healthcheck_interval" {
+ type = string
+ default = "20s"
+ description = "Interval passed to sitectl healthcheck on the VM and from the runner."
+}
+
+variable "tags" {
+ type = list(string)
+ default = ["cloud-compose"]
+ description = "Extra provider tags applied to smoke-test resources."
+}
+
+variable "cloud_compose_source_ref" {
+ type = string
+ default = "main"
+ description = "cloud-compose Git ref whose rootfs is fetched by providers with metadata size limits."
+}
diff --git a/tests/smoke/digitalocean-isle/.terraform.lock.hcl b/tests/smoke/digitalocean-isle/.terraform.lock.hcl
deleted file mode 100644
index 2e1681e..0000000
--- a/tests/smoke/digitalocean-isle/.terraform.lock.hcl
+++ /dev/null
@@ -1,47 +0,0 @@
-# This file is maintained automatically by "terraform init".
-# Manual edits may be lost in future updates.
-
-provider "registry.terraform.io/digitalocean/digitalocean" {
- version = "2.93.0"
- constraints = "~> 2.0"
- hashes = [
- "h1:furxWCm/4BbtUX/XHa3TsP0eI+YjQekvcUTyx4BLqnM=",
- "zh:2509716282fb0d04027279b2d6ffb449d5f4b4a5f380a2ad7b7b6221d2f2fdc4",
- "zh:3a6407123d127b6948040583c29371b6ea92120d2a239d8bcd27673725673013",
- "zh:71443c90f85572fce0c563e3587d956afb8be9f0a0090f1c40b33b1005718824",
- "zh:790c8a3694baba6e28b13d45d86523995ffda4693e0c8ad1584e34deee914fe2",
- "zh:7fe00fd5d4d322923550651b6ebca9dea14b3b7a68c09ba4c20f9b416a34cb40",
- "zh:8bf4d5ccb634bacba929fc632d554eddb349b890d26e5f4dbcb53481ca34dbff",
- "zh:8f545ec1622fa4d42a7112de8cbd0c42f8967e8dafd5c514d77b7ec25914951d",
- "zh:98300c632e9eabdcecb9f77586a4a48e19dab62b7365410f4ab857ab4007e159",
- "zh:9db648994459fe62a9e91f9d875dd9220db5b063a00f4eec22dbdf2247a67730",
- "zh:9f21713916718613da2a42c8b39c503e46399b2d06c3b492979bde939d05d2bb",
- "zh:a4b4afa0ef6f672d50ac072cae1a39ec6d97716e4ed118900b5db1a553a3c1cd",
- "zh:bebed73ab49be830ef03346cb91e1da83fff06b555695f69fc3de13c51a456ec",
- "zh:d207d54f3ab86a0f71c194b8b34a49a219f97dd40ec6db0ed13ed70df9f26aab",
- "zh:ee4caa17a2e62bfa9c2669ddd909026a3ded3294c4f2bb325cf563f5766e1981",
- "zh:efb59a5436f103a4930a7cab2e77ba75d31fd08f2f024c9a4177c70a89cd3264",
- "zh:ffaf97ab916b12c2181bdf5f7232aaac88cce59bb8edbad07a527207da232f90",
- ]
-}
-
-provider "registry.terraform.io/hashicorp/random" {
- version = "3.9.0"
- constraints = "~> 3.7"
- hashes = [
- "h1:UlBuNVuCGJ39tTv2c5gz2NRZnQbXfbIWbTzWcth5o74=",
- "zh:161ad0bd9a75768c82f53fb6e7172a9d8be2d4889b012645a34795031aaf1bf1",
- "zh:19dc9a5b17729725ccfc4f45b0500af0ee5bc6b6b160c7adb8f2bf617d2c80ea",
- "zh:269eda8fe42daa7974d5a34d166c3ba9defe80cde86c01e4dadcfdf2e1f05e5f",
- "zh:373f7c65566f8f2cc7f45d698654feb9d988996957e1266a69ca00c52d6d16d0",
- "zh:5599d16804c41c83009ec621b6d6b6f74e102f5827678a4750f8809055546b61",
- "zh:583be0440469a22bff70dcfa56593b01566860b29607437264adb51060cf46fc",
- "zh:5f211d8ec3f2e1f414870d9584bfe26e6995560ef81c748f8447a48164767398",
- "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
- "zh:7b547fd16216761ef86efc3ed516ac5ac0c5c42b7c7eb24a08cef2d93f69ed5e",
- "zh:7e7c0679daf2a382151d05068c8c3f0dae6b7b7dccf818827b73dd08638df2ef",
- "zh:8089dec888a8038b9b4fb23b3df7e1057293dbc5b60b42cc47ff690d69d4b61b",
- "zh:c51f15a031edfd6f23ce8ced3446ca7f8d8d647e2499890d7d5d10d5016d7257",
- "zh:c94784f005708890dc6895afd53636ec00ec1e430b15d41e5aebfb1d4b39bd04",
- ]
-}
diff --git a/tests/smoke/digitalocean-isle/main.tf b/tests/smoke/digitalocean-isle/main.tf
deleted file mode 100644
index e04d5b1..0000000
--- a/tests/smoke/digitalocean-isle/main.tf
+++ /dev/null
@@ -1,88 +0,0 @@
-terraform {
- required_version = ">= 1.2.4"
-
- required_providers {
- digitalocean = {
- source = "digitalocean/digitalocean"
- version = "~> 2.0"
- }
- random = {
- source = "hashicorp/random"
- version = "~> 3.7"
- }
- }
-}
-
-provider "digitalocean" {}
-
-resource "random_id" "suffix" {
- byte_length = 3
-}
-
-locals {
- smoke_run_id = substr(replace(lower(var.smoke_run_id), "/[^a-z0-9-]/", "-"), 0, 16)
- name = substr(join("-", compact([var.name_prefix, local.smoke_run_id, random_id.suffix.hex])), 0, 46)
- tags = distinct(concat(var.tags, ["cloud-compose-smoke", "digitalocean-isle"], local.smoke_run_id != "" ? ["gha-run-${local.smoke_run_id}"] : []))
-}
-
-module "isle" {
- source = "../../../modules/digitalocean"
-
- name = local.name
- digitalocean = {
- region = var.region
- tags = local.tags
- droplet = {
- size = var.size
- image = var.image
- monitoring = true
- ipv6 = true
- backups = false
- }
- ssh = {
- cloud_compose_keys = distinct(concat([var.ssh_public_key], var.operator_ssh_public_keys))
- }
- volumes = {
- data_size_gb = var.data_volume_size_gb
- docker_volumes_size_gb = var.docker_volumes_volume_size_gb
- }
- }
- runtime = {
- compose = {
- repo = var.docker_compose_repo
- branch = var.docker_compose_branch
- ingress_port = var.ingress_port
- up = [
- "sitectl compose --context \"$${SITECTL_CONTEXT_NAME}\" up -d --remove-orphans",
- "sitectl healthcheck --context \"$${SITECTL_CONTEXT_NAME}\" --persist --timeout \"$${SITECTL_HEALTHCHECK_TIMEOUT}\" --interval \"$${SITECTL_HEALTHCHECK_INTERVAL}\""
- ]
- }
- sitectl = {
- packages = ["sitectl", "sitectl-drupal", "sitectl-isle"]
- plugin = "isle"
- environment = "smoke"
- healthcheck_timeout = var.healthcheck_timeout
- healthcheck_interval = var.healthcheck_interval
- }
- }
-}
-
-output "smoke" {
- description = "Remote sitectl context details for the smoke test runner."
- value = {
- provider = "digitalocean"
- app = "isle"
- host = module.isle.instance.ipv4
- ssh_user = "cloud-compose"
- ssh_port = 22
- context_name = module.isle.primary_compose_project.sitectl_context_name
- plugin = module.isle.primary_compose_project.sitectl_plugin
- environment = module.isle.primary_compose_project.sitectl_environment
- site = local.name
- project_name = local.name
- project_dir = module.isle.primary_compose_project.project_dir
- compose_project_name = module.isle.primary_compose_project.compose_project_name
- healthcheck_timeout = var.healthcheck_timeout
- healthcheck_interval = var.healthcheck_interval
- }
-}
diff --git a/tests/smoke/digitalocean-isle/variables.tf b/tests/smoke/digitalocean-isle/variables.tf
deleted file mode 100644
index 0093e66..0000000
--- a/tests/smoke/digitalocean-isle/variables.tf
+++ /dev/null
@@ -1,100 +0,0 @@
-variable "name_prefix" {
- type = string
- default = "cc-do-isle"
- description = "Prefix for disposable smoke-test resources."
-
- validation {
- condition = can(regex("^[a-z][a-z0-9-]{0,35}$", var.name_prefix))
- error_message = "name_prefix must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens."
- }
-}
-
-variable "region" {
- type = string
- default = "tor1"
- description = "DigitalOcean region slug."
-}
-
-variable "size" {
- type = string
- default = "s-4vcpu-8gb"
- description = "DigitalOcean Droplet size slug."
-}
-
-variable "image" {
- type = string
- default = "ubuntu-24-04-x64"
- description = "DigitalOcean Droplet image slug."
-}
-
-variable "ssh_public_key" {
- type = string
- description = "Public SSH key authorized for the cloud-compose user."
-
- validation {
- condition = trimspace(var.ssh_public_key) != ""
- error_message = "ssh_public_key is required."
- }
-}
-
-variable "operator_ssh_public_keys" {
- type = list(string)
- default = [
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOuUgUvvcJyWVZkgLrBGGI9RfcNmQsw32QNftNS5/Iiv jcorall@MacBookPro"
- ]
- description = "Additional SSH public keys authorized for the cloud-compose user during smoke tests."
-}
-
-variable "smoke_run_id" {
- type = string
- default = ""
- description = "Optional GitHub Actions run id used to tag and name disposable smoke-test resources."
-}
-
-variable "docker_compose_repo" {
- type = string
- default = "https://github.com/libops/isle"
- description = "ISLE compose template repository."
-}
-
-variable "docker_compose_branch" {
- type = string
- default = "main"
- description = "ISLE compose template branch."
-}
-
-variable "ingress_port" {
- type = number
- default = 80
- description = "Host port exposed by Traefik."
-}
-
-variable "data_volume_size_gb" {
- type = number
- default = 10
- description = "Disposable smoke-test data volume size."
-}
-
-variable "docker_volumes_volume_size_gb" {
- type = number
- default = 30
- description = "Disposable smoke-test Docker volumes volume size."
-}
-
-variable "healthcheck_timeout" {
- type = string
- default = "30m"
- description = "Timeout passed to sitectl healthcheck on the VM and from the runner."
-}
-
-variable "healthcheck_interval" {
- type = string
- default = "20s"
- description = "Interval passed to sitectl healthcheck on the VM and from the runner."
-}
-
-variable "tags" {
- type = list(string)
- default = ["cloud-compose"]
- description = "Extra DigitalOcean tags applied to smoke-test resources."
-}
diff --git a/tests/smoke/gcp-wp/main.tf b/tests/smoke/gcp-wp/main.tf
deleted file mode 100644
index b563a87..0000000
--- a/tests/smoke/gcp-wp/main.tf
+++ /dev/null
@@ -1,114 +0,0 @@
-terraform {
- required_version = ">= 1.2.4"
-
- required_providers {
- google = {
- source = "hashicorp/google"
- version = "~> 7.0"
- }
- random = {
- source = "hashicorp/random"
- version = "~> 3.7"
- }
- }
-}
-
-provider "google" {
- project = local.project_id
- region = var.gcp_region
- zone = var.gcp_zone
-}
-
-data "google_project" "current" {
- project_id = local.project_id
-}
-
-resource "random_id" "suffix" {
- byte_length = 2
-}
-
-locals {
- project_id = trimspace(var.gcp_project_id)
- smoke_run_id = substr(replace(lower(var.smoke_run_id), "/[^a-z0-9-]/", "-"), 0, 8)
- name = substr(join("-", compact([var.name_prefix, local.smoke_run_id, random_id.suffix.hex])), 0, 21)
-}
-
-module "wp" {
- source = "../../.."
-
- name = local.name
- gcp = {
- project_id = local.project_id
- project_number = data.google_project.current.number
- region = var.gcp_region
- zone = var.gcp_zone
- instance = {
- machine_type = var.machine_type
- os = var.os
- production = false
- }
- disks = {
- type = var.disk_type
- docker_volumes_size_gb = var.docker_volumes_volume_size_gb
- }
- snapshots = {
- enabled = false
- }
- network = {
- ssh_ipv4 = var.ssh_source_ranges
- ssh_ipv6 = []
- }
- power_management = {
- enabled = false
- }
- }
- runtime = {
- users = {
- cloud-compose = distinct(concat([var.ssh_public_key], var.operator_ssh_public_keys))
- }
- compose = {
- repo = var.docker_compose_repo
- branch = var.docker_compose_branch
- ingress_port = var.ingress_port
- up = [
- "sitectl compose --context \"$${SITECTL_CONTEXT_NAME}\" up -d --remove-orphans",
- "sitectl healthcheck --context \"$${SITECTL_CONTEXT_NAME}\" --persist --timeout \"$${SITECTL_HEALTHCHECK_TIMEOUT}\" --interval \"$${SITECTL_HEALTHCHECK_INTERVAL}\""
- ]
- }
- sitectl = {
- packages = ["sitectl", "sitectl-wp"]
- plugin = "wp"
- environment = "smoke"
- healthcheck_timeout = var.healthcheck_timeout
- healthcheck_interval = var.healthcheck_interval
- }
- managed_runtime = {
- enabled = true
- internal_services_enabled = false
- internal_services_auto_update = false
- }
- vault = {
- auth_method = "consumer-managed"
- }
- }
-}
-
-output "smoke" {
- description = "Remote sitectl context details for the smoke test runner."
- value = {
- provider = "gcp"
- app = "wp"
- host = module.wp.external_ip
- ssh_user = "cloud-compose"
- ssh_port = 22
- context_name = module.wp.primary_compose_project.sitectl_context_name
- plugin = module.wp.primary_compose_project.sitectl_plugin
- environment = module.wp.primary_compose_project.sitectl_environment
- site = local.name
- project_name = local.name
- project_dir = module.wp.primary_compose_project.project_dir
- compose_project_name = module.wp.primary_compose_project.compose_project_name
- healthcheck_timeout = var.healthcheck_timeout
- healthcheck_interval = var.healthcheck_interval
- }
-}
diff --git a/tests/smoke/gcp-wp/variables.tf b/tests/smoke/gcp-wp/variables.tf
deleted file mode 100644
index d6fe985..0000000
--- a/tests/smoke/gcp-wp/variables.tf
+++ /dev/null
@@ -1,116 +0,0 @@
-variable "name_prefix" {
- type = string
- default = "cc-gwp"
- description = "Prefix for disposable smoke-test resources."
-
- validation {
- condition = can(regex("^[a-z][a-z0-9-]{0,8}$", var.name_prefix))
- error_message = "name_prefix must start with a lowercase letter, contain only lowercase letters, numbers, and hyphens, and leave room for service account prefixes."
- }
-}
-
-variable "gcp_project_id" {
- type = string
- description = "Google Cloud project used for disposable smoke-test resources."
-
- validation {
- condition = trimspace(var.gcp_project_id) != ""
- error_message = "gcp_project_id is required."
- }
-}
-
-variable "gcp_region" {
- type = string
- default = "us-east5"
- description = "Google Cloud region for smoke-test resources."
-}
-
-variable "gcp_zone" {
- type = string
- default = "us-east5-b"
- description = "Google Cloud zone for smoke-test resources."
-}
-
-variable "machine_type" {
- type = string
- default = "e2-medium"
- description = "Google Compute Engine machine type."
-}
-
-variable "disk_type" {
- type = string
- default = "pd-standard"
- description = "Google Compute Engine disk type."
-}
-
-variable "os" {
- type = string
- default = "cos-125-19216-220-185"
- description = "Compute-optimized OS image name."
-}
-
-variable "ssh_public_key" {
- type = string
- description = "Public SSH key authorized for the cloud-compose user."
-
- validation {
- condition = trimspace(var.ssh_public_key) != ""
- error_message = "ssh_public_key is required."
- }
-}
-
-variable "operator_ssh_public_keys" {
- type = list(string)
- default = [
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOuUgUvvcJyWVZkgLrBGGI9RfcNmQsw32QNftNS5/Iiv jcorall@MacBookPro"
- ]
- description = "Additional SSH public keys authorized for operator access during smoke tests."
-}
-
-variable "ssh_source_ranges" {
- type = list(string)
- default = ["0.0.0.0/0"]
- description = "CIDR IPv4 ranges allowed to SSH into the disposable smoke-test VM."
-}
-
-variable "smoke_run_id" {
- type = string
- default = ""
- description = "Optional GitHub Actions run id used to tag and name disposable smoke-test resources."
-}
-
-variable "docker_compose_repo" {
- type = string
- default = "https://github.com/libops/wp.git"
- description = "WordPress compose template repository."
-}
-
-variable "docker_compose_branch" {
- type = string
- default = "main"
- description = "WordPress compose template branch."
-}
-
-variable "ingress_port" {
- type = number
- default = 80
- description = "Host port exposed by Traefik."
-}
-
-variable "docker_volumes_volume_size_gb" {
- type = number
- default = 50
- description = "Persistent Docker volumes disk size."
-}
-
-variable "healthcheck_timeout" {
- type = string
- default = "20m"
- description = "Timeout passed to sitectl healthcheck on the VM and from the runner."
-}
-
-variable "healthcheck_interval" {
- type = string
- default = "20s"
- description = "Interval passed to sitectl healthcheck on the VM and from the runner."
-}
diff --git a/tests/smoke/linode-wp/.terraform.lock.hcl b/tests/smoke/linode-wp/.terraform.lock.hcl
deleted file mode 100644
index d835c18..0000000
--- a/tests/smoke/linode-wp/.terraform.lock.hcl
+++ /dev/null
@@ -1,44 +0,0 @@
-# This file is maintained automatically by "terraform init".
-# Manual edits may be lost in future updates.
-
-provider "registry.terraform.io/hashicorp/random" {
- version = "3.9.0"
- constraints = "~> 3.7"
- hashes = [
- "h1:UlBuNVuCGJ39tTv2c5gz2NRZnQbXfbIWbTzWcth5o74=",
- "zh:161ad0bd9a75768c82f53fb6e7172a9d8be2d4889b012645a34795031aaf1bf1",
- "zh:19dc9a5b17729725ccfc4f45b0500af0ee5bc6b6b160c7adb8f2bf617d2c80ea",
- "zh:269eda8fe42daa7974d5a34d166c3ba9defe80cde86c01e4dadcfdf2e1f05e5f",
- "zh:373f7c65566f8f2cc7f45d698654feb9d988996957e1266a69ca00c52d6d16d0",
- "zh:5599d16804c41c83009ec621b6d6b6f74e102f5827678a4750f8809055546b61",
- "zh:583be0440469a22bff70dcfa56593b01566860b29607437264adb51060cf46fc",
- "zh:5f211d8ec3f2e1f414870d9584bfe26e6995560ef81c748f8447a48164767398",
- "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
- "zh:7b547fd16216761ef86efc3ed516ac5ac0c5c42b7c7eb24a08cef2d93f69ed5e",
- "zh:7e7c0679daf2a382151d05068c8c3f0dae6b7b7dccf818827b73dd08638df2ef",
- "zh:8089dec888a8038b9b4fb23b3df7e1057293dbc5b60b42cc47ff690d69d4b61b",
- "zh:c51f15a031edfd6f23ce8ced3446ca7f8d8d647e2499890d7d5d10d5016d7257",
- "zh:c94784f005708890dc6895afd53636ec00ec1e430b15d41e5aebfb1d4b39bd04",
- ]
-}
-
-provider "registry.terraform.io/linode/linode" {
- version = "4.0.0"
- constraints = "~> 4.0"
- hashes = [
- "h1:ZUykBGGXIJsXzafpxxKN+oRJh/n/d+jFiiTZlYVDrvY=",
- "zh:01e0045344d13ca61c8b065df73b007bf45f665eb419d045a31c8d9ba48ede86",
- "zh:3e22a4672940ec1a8c59bd6c8d594a6fb4bdfc50efa993ac2b9edd21a9459b03",
- "zh:467c82a79a04cc2f279b4b8206db691035dbcb3ba88f8a29a63e060046a7747b",
- "zh:4d7f3a1ec9dfa15ea2bac0f9670885812d09e45737d55c7daea049770143bc1d",
- "zh:4d9b946d66940231488990943f9564725891310f8500c149af380eba614f5ab4",
- "zh:75b48ac11262ac401c2fc3eb5fb73b01ad1607a1c2a0ddcb42687d1941158e6d",
- "zh:864de67a080eeb4b14902056dc96bd29f1dc935442440cdb774ad2d46a872ca9",
- "zh:a3fd99fb4f9b2e631c63b0ab9ff4d28e32aca4ff0a14b9271fdc634798ecc808",
- "zh:b0c63ea32e65a76e987a086dc4ee6d8f445876a59d7a5a94aa2f225f5fd8729f",
- "zh:b3d6f4461724983798af50bc91003b0e7892a5b2ab172d7fd0a8d57578c6a7bf",
- "zh:b5f2643c36657241b6ef4a987727e99352ed2dcf63d54cba6d5292ee0edd59f4",
- "zh:bf148ad0a4cdd049de12bdea2dc2bb20f2a0e09574a1917f7e45c1f54aa8dc0b",
- "zh:d1448b79e1c9c9d14adc03c97730f68fec042011012ec6727ff7b17d7e130df4",
- ]
-}
diff --git a/tests/smoke/linode-wp/main.tf b/tests/smoke/linode-wp/main.tf
deleted file mode 100644
index a843967..0000000
--- a/tests/smoke/linode-wp/main.tf
+++ /dev/null
@@ -1,87 +0,0 @@
-terraform {
- required_version = ">= 1.2.4"
-
- required_providers {
- linode = {
- source = "linode/linode"
- version = "~> 4.0"
- }
- random = {
- source = "hashicorp/random"
- version = "~> 3.7"
- }
- }
-}
-
-provider "linode" {}
-
-resource "random_id" "suffix" {
- byte_length = 3
-}
-
-locals {
- smoke_run_id = substr(replace(lower(var.smoke_run_id), "/[^a-z0-9-]/", "-"), 0, 16)
- name = substr(join("-", compact([var.name_prefix, local.smoke_run_id, random_id.suffix.hex])), 0, 46)
- tags = distinct(concat(var.tags, ["cloud-compose-smoke", "linode-wp"], local.smoke_run_id != "" ? ["gha-run-${local.smoke_run_id}"] : []))
-}
-
-module "wp" {
- source = "../../../modules/linode"
-
- name = local.name
- linode = {
- region = var.region
- tags = local.tags
- instance = {
- type = var.type
- image = var.image
- authorized_keys = distinct(concat([var.ssh_public_key], var.operator_ssh_public_keys))
- }
- ssh = {
- cloud_compose_keys = distinct(concat([var.ssh_public_key], var.operator_ssh_public_keys))
- }
- volumes = {
- data_size_gb = var.data_volume_size_gb
- docker_volumes_size_gb = var.docker_volumes_volume_size_gb
- }
- }
- runtime = {
- rootfs_archive_url = "https://github.com/libops/cloud-compose/archive/${var.cloud_compose_source_ref}.tar.gz"
- compose = {
- repo = var.docker_compose_repo
- branch = var.docker_compose_branch
- ingress_port = var.ingress_port
- up = [
- "sitectl compose --context \"$${SITECTL_CONTEXT_NAME}\" up -d --remove-orphans",
- "sitectl healthcheck --context \"$${SITECTL_CONTEXT_NAME}\" --persist --timeout \"$${SITECTL_HEALTHCHECK_TIMEOUT}\" --interval \"$${SITECTL_HEALTHCHECK_INTERVAL}\""
- ]
- }
- sitectl = {
- packages = ["sitectl", "sitectl-wp"]
- plugin = "wp"
- environment = "smoke"
- healthcheck_timeout = var.healthcheck_timeout
- healthcheck_interval = var.healthcheck_interval
- }
- }
-}
-
-output "smoke" {
- description = "Remote sitectl context details for the smoke test runner."
- value = {
- provider = "linode"
- app = "wp"
- host = module.wp.instance.public_ipv4
- ssh_user = "cloud-compose"
- ssh_port = 22
- context_name = module.wp.primary_compose_project.sitectl_context_name
- plugin = module.wp.primary_compose_project.sitectl_plugin
- environment = module.wp.primary_compose_project.sitectl_environment
- site = local.name
- project_name = local.name
- project_dir = module.wp.primary_compose_project.project_dir
- compose_project_name = module.wp.primary_compose_project.compose_project_name
- healthcheck_timeout = var.healthcheck_timeout
- healthcheck_interval = var.healthcheck_interval
- }
-}
diff --git a/tests/smoke/linode-wp/variables.tf b/tests/smoke/linode-wp/variables.tf
deleted file mode 100644
index bc529b5..0000000
--- a/tests/smoke/linode-wp/variables.tf
+++ /dev/null
@@ -1,106 +0,0 @@
-variable "name_prefix" {
- type = string
- default = "cc-linode-wp"
- description = "Prefix for disposable smoke-test resources."
-
- validation {
- condition = can(regex("^[a-z][a-z0-9-]{0,35}$", var.name_prefix))
- error_message = "name_prefix must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens."
- }
-}
-
-variable "region" {
- type = string
- default = "us-east"
- description = "Linode region slug."
-}
-
-variable "type" {
- type = string
- default = "g6-standard-2"
- description = "Linode instance type."
-}
-
-variable "image" {
- type = string
- default = "linode/ubuntu22.04"
- description = "Linode image slug."
-}
-
-variable "ssh_public_key" {
- type = string
- description = "Public SSH key authorized for the root and cloud-compose users."
-
- validation {
- condition = trimspace(var.ssh_public_key) != ""
- error_message = "ssh_public_key is required."
- }
-}
-
-variable "operator_ssh_public_keys" {
- type = list(string)
- default = [
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOuUgUvvcJyWVZkgLrBGGI9RfcNmQsw32QNftNS5/Iiv jcorall@MacBookPro"
- ]
- description = "Additional SSH public keys authorized for operator access during smoke tests."
-}
-
-variable "smoke_run_id" {
- type = string
- default = ""
- description = "Optional GitHub Actions run id used to tag and name disposable smoke-test resources."
-}
-
-variable "docker_compose_repo" {
- type = string
- default = "https://github.com/libops/wp.git"
- description = "WordPress compose template repository."
-}
-
-variable "docker_compose_branch" {
- type = string
- default = "main"
- description = "WordPress compose template branch."
-}
-
-variable "ingress_port" {
- type = number
- default = 80
- description = "Host port exposed by Traefik."
-}
-
-variable "data_volume_size_gb" {
- type = number
- default = 10
- description = "Disposable smoke-test data volume size."
-}
-
-variable "docker_volumes_volume_size_gb" {
- type = number
- default = 20
- description = "Disposable smoke-test Docker volumes volume size."
-}
-
-variable "healthcheck_timeout" {
- type = string
- default = "20m"
- description = "Timeout passed to sitectl healthcheck on the VM and from the runner."
-}
-
-variable "healthcheck_interval" {
- type = string
- default = "20s"
- description = "Interval passed to sitectl healthcheck on the VM and from the runner."
-}
-
-variable "tags" {
- type = list(string)
- default = ["cloud-compose"]
- description = "Extra Linode tags applied to smoke-test resources."
-}
-
-variable "cloud_compose_source_ref" {
- type = string
- default = "main"
- description = "cloud-compose Git ref whose rootfs is fetched by Linode cloud-init."
-}
diff --git a/variables.tf b/variables.tf
index 8dc8adc..d2387b0 100644
--- a/variables.tf
+++ b/variables.tf
@@ -3,11 +3,33 @@ variable "name" {
description = "Deployment name."
}
+variable "cloud_provider" {
+ type = string
+ default = "gcp"
+ description = "Cloud provider to deploy to. Supported values are gcp, digitalocean, and linode."
+
+ validation {
+ condition = contains(["gcp", "digitalocean", "linode"], lower(trimspace(var.cloud_provider)))
+ error_message = "cloud_provider must be gcp, digitalocean, or linode."
+ }
+}
+
+variable "template" {
+ type = string
+ default = ""
+ description = "Optional compose template preset. Supported values are archivesspace, ojs, isle, drupal, wp, omeka-s, and omeka-classic. Explicit runtime settings override preset defaults."
+
+ validation {
+ condition = contains(["", "archivesspace", "ojs", "isle", "drupal", "wp", "omeka-s", "omeka-classic"], lower(trimspace(var.template)))
+ error_message = "template must be empty, archivesspace, ojs, isle, drupal, wp, omeka-s, or omeka-classic."
+ }
+}
+
variable "gcp" {
description = "Google Cloud infrastructure settings."
type = object({
- project_id = string
- project_number = string
+ project_id = optional(string, "")
+ project_number = optional(string, "")
region = optional(string, "us-east5")
zone = optional(string, "us-east5-b")
@@ -77,6 +99,7 @@ variable "gcp" {
allowed_ipv4 = optional(list(string), ["10.0.0.0/8"])
}), {})
})
+ default = {}
validation {
condition = contains([
@@ -117,11 +140,86 @@ variable "gcp" {
}
}
+variable "digitalocean" {
+ description = "DigitalOcean infrastructure settings."
+ type = object({
+ region = optional(string, "tor1")
+ tags = optional(list(string), ["cloud-compose"])
+
+ droplet = optional(object({
+ size = optional(string, "s-2vcpu-4gb")
+ image = optional(string, "ubuntu-24-04-x64")
+ ssh_keys = optional(list(string), [])
+ vpc_uuid = optional(string, null)
+ monitoring = optional(bool, true)
+ ipv6 = optional(bool, true)
+ backups = optional(bool, false)
+ }), {})
+
+ ssh = optional(object({
+ cloud_compose_keys = optional(list(string), [])
+ users = optional(map(list(string)), {})
+ }), {})
+
+ volumes = optional(object({
+ data_size_gb = optional(number, 50)
+ docker_volumes_size_gb = optional(number, 100)
+ }), {})
+
+ firewall = optional(object({
+ enabled = optional(bool, true)
+ ssh_source_addresses = optional(list(string), ["0.0.0.0/0", "::/0"])
+ web_source_addresses = optional(list(string), ["0.0.0.0/0", "::/0"])
+ }), {})
+ })
+ default = {}
+}
+
+variable "linode" {
+ description = "Linode infrastructure settings."
+ type = object({
+ region = optional(string, "us-east")
+ tags = optional(list(string), ["cloud-compose"])
+
+ instance = optional(object({
+ type = optional(string, "g6-standard-2")
+ image = optional(string, "linode/ubuntu22.04")
+ authorized_keys = optional(list(string), [])
+ authorized_users = optional(list(string), [])
+ root_pass = optional(string, null)
+ private_ip = optional(bool, true)
+ backups_enabled = optional(bool, false)
+ watchdog_enabled = optional(bool, true)
+ }), {})
+
+ ssh = optional(object({
+ cloud_compose_keys = optional(list(string), [])
+ users = optional(map(list(string)), {})
+ }), {})
+
+ volumes = optional(object({
+ data_size_gb = optional(number, 50)
+ docker_volumes_size_gb = optional(number, 100)
+ }), {})
+
+ firewall = optional(object({
+ enabled = optional(bool, true)
+ ssh_source_ipv4 = optional(list(string), ["0.0.0.0/0"])
+ ssh_source_ipv6 = optional(list(string), ["::/0"])
+ web_source_ipv4 = optional(list(string), ["0.0.0.0/0"])
+ web_source_ipv6 = optional(list(string), ["::/0"])
+ }), {})
+ })
+ default = {}
+}
+
variable "runtime" {
description = "Provider-neutral compose/runtime settings."
type = object({
- rootfs = optional(string, "")
- users = optional(map(list(string)), {})
+ rootfs = optional(string, "")
+ rootfs_archive_url = optional(string, "")
+ rootfs_archive_sha256 = optional(string, "")
+ users = optional(map(list(string)), {})
compose = optional(object({
primary = optional(string, "")
@@ -236,6 +334,8 @@ variable "runtime" {
command = optional(string, "")
})), [])
}), {})
+
+ extra_env = optional(map(string), {})
})
default = {}
From 1bf7c97c64c54de10baf139e82e45622f88c3fe2 Mon Sep 17 00:00:00 2001
From: "H.E. Pennypacker" <115990865+pennypacker-he@users.noreply.github.com>
Date: Sun, 5 Jul 2026 19:07:17 +0000
Subject: [PATCH 3/8] [minor] Fix non-GCP smoke provider config
---
tests/smoke/app/main.tf | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/tests/smoke/app/main.tf b/tests/smoke/app/main.tf
index 3740f69..db061bf 100644
--- a/tests/smoke/app/main.tf
+++ b/tests/smoke/app/main.tf
@@ -24,9 +24,10 @@ terraform {
provider "digitalocean" {}
provider "google" {
- project = local.project_id
- region = var.gcp_region
- zone = var.gcp_zone
+ access_token = local.cloud_provider == "gcp" ? null : "unused"
+ project = local.cloud_provider == "gcp" ? local.project_id : "unused"
+ region = var.gcp_region
+ zone = var.gcp_zone
}
provider "linode" {}
From df8316bf93fea8b6398957430c244a6f0e1efcf1 Mon Sep 17 00:00:00 2001
From: "H.E. Pennypacker" <115990865+pennypacker-he@users.noreply.github.com>
Date: Sun, 5 Jul 2026 19:35:29 +0000
Subject: [PATCH 4/8] [minor] Scaffold compose template secrets
---
ci/cloud-smoke.sh | 6 +-
rootfs/home/cloud-compose/app-init.sh | 1 +
rootfs/home/cloud-compose/compose-apps.sh | 200 ++++++++++++++++++++++
3 files changed, 206 insertions(+), 1 deletion(-)
diff --git a/ci/cloud-smoke.sh b/ci/cloud-smoke.sh
index 1b80bb5..f93bcdf 100755
--- a/ci/cloud-smoke.sh
+++ b/ci/cloud-smoke.sh
@@ -566,7 +566,11 @@ echo \"--- docker ps ---\"
sudo docker ps -a
echo \"--- docker compose ps ---\"
if [ -d ${quoted_project_dir} ]; then
- runuser -u cloud-compose -- env HOME=/home/cloud-compose PROJECT_DIR=${quoted_project_dir} bash -lc \"source /home/cloud-compose/profile.sh && cd \\\"\$PROJECT_DIR\\\" && docker compose ps\"
+ if command -v runuser >/dev/null 2>&1; then
+ runuser -u cloud-compose -- env HOME=/home/cloud-compose PROJECT_DIR=${quoted_project_dir} bash -lc \"source /home/cloud-compose/profile.sh && cd \\\"\$PROJECT_DIR\\\" && docker compose ps\"
+ else
+ sudo -u cloud-compose env HOME=/home/cloud-compose PROJECT_DIR=${quoted_project_dir} bash -lc \"source /home/cloud-compose/profile.sh && cd \\\"\$PROJECT_DIR\\\" && docker compose ps\"
+ fi
else
echo \"Project directory ${project_dir} is not present yet\"
fi
diff --git a/rootfs/home/cloud-compose/app-init.sh b/rootfs/home/cloud-compose/app-init.sh
index a34c469..8e1d9e2 100644
--- a/rootfs/home/cloud-compose/app-init.sh
+++ b/rootfs/home/cloud-compose/app-init.sh
@@ -18,6 +18,7 @@ while read -r app; do
source_compose_app_env "$app"
pushd "$DOCKER_COMPOSE_DIR" >/dev/null
+ scaffold_compose_app_defaults "$app"
update_env COMPOSE_PROJECT_NAME "$COMPOSE_PROJECT_NAME"
update_env SITE_NAME "${CLOUD_COMPOSE_INSTANCE_NAME:-${GCP_INSTANCE_NAME:-$app}}"
update_env COMPOSE_BIND_PORT "$COMPOSE_BIND_PORT"
diff --git a/rootfs/home/cloud-compose/compose-apps.sh b/rootfs/home/cloud-compose/compose-apps.sh
index 77ffb3f..f3d9b4f 100644
--- a/rootfs/home/cloud-compose/compose-apps.sh
+++ b/rootfs/home/cloud-compose/compose-apps.sh
@@ -64,6 +64,206 @@ sitectl_truthy() {
esac
}
+random_chars() {
+ local chars="$1"
+ local length="$2"
+ local value=""
+
+ while [ "${#value}" -lt "$length" ]; do
+ value="${value}$(openssl rand -base64 "$((length * 2))" | tr -dc "$chars")"
+ done
+
+ printf '%s' "${value:0:length}"
+}
+
+random_secret() {
+ local length="$1"
+
+ random_chars 'A-Za-z0-9' "$length"
+}
+
+scaffold_secret_file() {
+ local file="$1"
+ local mode="${2:-0640}"
+
+ if [ -s "$file" ]; then
+ return 0
+ fi
+
+ install -d -m 0700 "$(dirname "$file")"
+ echo "Creating scaffold secret: ${file}" >&2
+ random_secret 32 > "$file"
+ chmod "$mode" "$file"
+}
+
+scaffold_drupal_salt() {
+ local file="$1"
+
+ if [ -s "$file" ]; then
+ return 0
+ fi
+
+ install -d -m 0700 "$(dirname "$file")"
+ echo "Creating scaffold secret: ${file}" >&2
+ random_chars 'A-Za-z0-9_-' 74 > "$file"
+ chmod 0640 "$file"
+}
+
+scaffold_jwt_keys() {
+ local private_key="${1:-./secrets/JWT_PRIVATE_KEY}"
+ local public_key="${2:-./secrets/JWT_PUBLIC_KEY}"
+
+ install -d -m 0700 "$(dirname "$private_key")"
+ if [ ! -s "$private_key" ]; then
+ echo "Creating scaffold secret: ${private_key}" >&2
+ openssl genrsa 2048 > "$private_key" 2>/dev/null
+ chmod 0640 "$private_key"
+ fi
+ if [ ! -s "$public_key" ]; then
+ echo "Creating scaffold secret: ${public_key}" >&2
+ openssl rsa -pubout < "$private_key" > "$public_key" 2>/dev/null
+ chmod 0644 "$public_key"
+ fi
+}
+
+scaffold_local_certs() {
+ local cert_dir="${1:-./certs}"
+ local openssl_config
+
+ if [ -s "${cert_dir}/cert.pem" ] && [ -s "${cert_dir}/rootCA.pem" ]; then
+ return 0
+ fi
+
+ install -d -m 0755 "$cert_dir"
+ openssl_config="$(mktemp)"
+ cat > "$openssl_config" <<'EOF'
+[req]
+distinguished_name = req_distinguished_name
+prompt = no
+
+[req_distinguished_name]
+CN = localhost
+
+[v3_req]
+subjectAltName = @alt_names
+
+[alt_names]
+DNS.1 = localhost
+DNS.2 = *.localhost
+DNS.3 = islandora.io
+DNS.4 = *.islandora.io
+DNS.5 = islandora.info
+DNS.6 = *.islandora.info
+IP.1 = 127.0.0.1
+IP.2 = ::1
+EOF
+
+ if [ ! -s "${cert_dir}/rootCA-key.pem" ] || [ ! -s "${cert_dir}/rootCA.pem" ]; then
+ echo "Creating scaffold certificate authority in ${cert_dir}" >&2
+ openssl req -x509 -newkey rsa:2048 -nodes \
+ -keyout "${cert_dir}/rootCA-key.pem" \
+ -out "${cert_dir}/rootCA.pem" \
+ -subj "/CN=cloud-compose local root" \
+ -days 3650 >/dev/null 2>&1
+ fi
+
+ if [ ! -s "${cert_dir}/privkey.pem" ] || [ ! -s "${cert_dir}/cert.pem" ]; then
+ echo "Creating scaffold certificate in ${cert_dir}" >&2
+ openssl req -newkey rsa:2048 -nodes \
+ -keyout "${cert_dir}/privkey.pem" \
+ -out "${cert_dir}/cert.csr" \
+ -config "$openssl_config" >/dev/null 2>&1
+ openssl x509 -req \
+ -in "${cert_dir}/cert.csr" \
+ -CA "${cert_dir}/rootCA.pem" \
+ -CAkey "${cert_dir}/rootCA-key.pem" \
+ -CAcreateserial \
+ -out "${cert_dir}/cert.pem" \
+ -days 825 \
+ -sha256 \
+ -extensions v3_req \
+ -extfile "$openssl_config" >/dev/null 2>&1
+ rm -f "${cert_dir}/cert.csr"
+ fi
+
+ rm -f "$openssl_config"
+ chmod 0644 "${cert_dir}/cert.pem" "${cert_dir}/rootCA.pem"
+ chmod 0640 "${cert_dir}/privkey.pem" "${cert_dir}/rootCA-key.pem" 2>/dev/null || true
+}
+
+compose_secret_files() {
+ local compose_file
+
+ for compose_file in docker-compose.yaml docker-compose.yml; do
+ if [ ! -f "$compose_file" ]; then
+ continue
+ fi
+
+ awk '
+ /^[[:space:]]*services:/ { in_secrets = 0 }
+ /^[^[:space:]][^:]*:/ {
+ if ($0 ~ /^secrets:/) {
+ in_secrets = 1
+ } else if (in_secrets) {
+ in_secrets = 0
+ }
+ }
+ in_secrets && /^[[:space:]]*file:[[:space:]]*/ {
+ value = $0
+ sub(/^[[:space:]]*file:[[:space:]]*/, "", value)
+ gsub(/^["'\'']|["'\'']$/, "", value)
+ print value
+ }
+ ' "$compose_file"
+ done | sort -u
+}
+
+scaffold_compose_app_defaults() {
+ local app="$1"
+ local file base generated=false
+
+ echo "Scaffolding default compose files for ${app}"
+ while IFS= read -r file; do
+ if [ -z "$file" ]; then
+ continue
+ fi
+
+ generated=true
+ base="$(basename "$file")"
+ case "$file" in
+ ./*) ;;
+ *) file="./${file}" ;;
+ esac
+
+ case "$base" in
+ cert.pem | rootCA.pem | privkey.pem | rootCA-key.pem)
+ scaffold_local_certs "$(dirname "$file")"
+ ;;
+ UID)
+ install -d -m 0755 "$(dirname "$file")"
+ id -u > "$file"
+ chmod 0644 "$file"
+ ;;
+ DRUPAL_DEFAULT_SALT)
+ scaffold_drupal_salt "$file"
+ ;;
+ JWT_PRIVATE_KEY)
+ scaffold_jwt_keys "$file" "./secrets/JWT_PUBLIC_KEY"
+ ;;
+ JWT_PUBLIC_KEY)
+ scaffold_jwt_keys "./secrets/JWT_PRIVATE_KEY" "$file"
+ ;;
+ *)
+ scaffold_secret_file "$file"
+ ;;
+ esac
+ done < <(compose_secret_files)
+
+ if [ "$generated" = false ]; then
+ echo "No compose secret files declared for ${app}"
+ fi
+}
+
write_compose_app_env() {
local app="$1"
local env_file="${COMPOSE_APPS_ENV_DIR}/${app}.env"
From 8881c8af214d1964a4ccbbb5938fa047a8c6c652 Mon Sep 17 00:00:00 2001
From: "H.E. Pennypacker" <115990865+pennypacker-he@users.noreply.github.com>
Date: Sun, 5 Jul 2026 19:55:36 +0000
Subject: [PATCH 5/8] [minor] Install template sitectl plugins
---
main.tf | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/main.tf b/main.tf
index ae13795..784d019 100644
--- a/main.tf
+++ b/main.tf
@@ -76,7 +76,7 @@ locals {
})
sitectl = merge(local.input_sitectl, {
packages = (
- local.template_name != "" && local.input_sitectl.packages == ["sitectl"]
+ local.template_name != "" && length(local.input_sitectl.packages) == 1 && local.input_sitectl.packages[0] == "sitectl"
? local.template.packages
: local.input_sitectl.packages
)
From 15f6235c3da9aac51de0bc8f788ee15269cc766e Mon Sep 17 00:00:00 2001
From: "H.E. Pennypacker" <115990865+pennypacker-he@users.noreply.github.com>
Date: Sun, 5 Jul 2026 20:14:07 +0000
Subject: [PATCH 6/8] [minor] Align compose healthcheck timeout defaults
---
README.md | 2 +-
modules/digitalocean/variables.tf | 2 +-
modules/linode/variables.tf | 2 +-
variables.tf | 2 +-
4 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/README.md b/README.md
index f023fc8..124b48b 100644
--- a/README.md
+++ b/README.md
@@ -35,7 +35,7 @@ No resources.
| [digitalocean](#input\_digitalocean) | DigitalOcean infrastructure settings. | object({
region = optional(string, "tor1")
tags = optional(list(string), ["cloud-compose"])
droplet = optional(object({
size = optional(string, "s-2vcpu-4gb")
image = optional(string, "ubuntu-24-04-x64")
ssh_keys = optional(list(string), [])
vpc_uuid = optional(string, null)
monitoring = optional(bool, true)
ipv6 = optional(bool, true)
backups = optional(bool, false)
}), {})
ssh = optional(object({
cloud_compose_keys = optional(list(string), [])
users = optional(map(list(string)), {})
}), {})
volumes = optional(object({
data_size_gb = optional(number, 50)
docker_volumes_size_gb = optional(number, 100)
}), {})
firewall = optional(object({
enabled = optional(bool, true)
ssh_source_addresses = optional(list(string), ["0.0.0.0/0", "::/0"])
web_source_addresses = optional(list(string), ["0.0.0.0/0", "::/0"])
}), {})
}) | `{}` | no |
| [gcp](#input\_gcp) | Google Cloud infrastructure settings. | object({
project_id = optional(string, "")
project_number = optional(string, "")
region = optional(string, "us-east5")
zone = optional(string, "us-east5-b")
identity = optional(object({
vm_service_account_email = optional(string, "")
app_service_account_email = optional(string, "")
}), {})
instance = optional(object({
machine_type = optional(string, "n4-standard-2")
os = optional(string, "cos-125-19216-220-185")
production = optional(bool, false)
}), {})
disks = optional(object({
type = optional(string, "hyperdisk-balanced")
docker_volumes_size_gb = optional(number, 50)
}), {})
network = optional(object({
create = optional(bool, true)
name = optional(string, "")
subnetwork = optional(string, "")
ip_cidr_range = optional(string, "10.42.0.0/24")
power_button_allowed_ips = optional(list(string), [])
ssh_ipv4 = optional(list(string), [])
ssh_ipv6 = optional(list(string), [])
}), {})
snapshots = optional(object({
enabled = optional(bool, false)
}), {})
overlay = optional(object({
source_instance = optional(string, "")
volume_names = optional(list(string), [])
}), {})
cloud_init = optional(object({
initcmd = optional(list(string), [])
runcmd = optional(list(string), [])
}), {})
artifact_registry = optional(object({
repository = optional(string, "")
location = optional(string, "us")
}), {})
power_management = optional(object({
enabled = optional(bool, true)
frontend = optional(object({
image = string
port = optional(number, 8080)
cpu = optional(string, "1000m")
memory = optional(string, "1Gi")
}), null)
}), {})
rollout = optional(object({
enabled = optional(bool, false)
release_url = optional(string, "")
release_sha256 = optional(string, "")
port = optional(number, 8081)
jwks_uri = optional(string, "")
jwt_audience = optional(string, "")
custom_claims = optional(string, "")
allowed_ipv4 = optional(list(string), ["10.0.0.0/8"])
}), {})
}) | `{}` | no |
| [linode](#input\_linode) | Linode infrastructure settings. | object({
region = optional(string, "us-east")
tags = optional(list(string), ["cloud-compose"])
instance = optional(object({
type = optional(string, "g6-standard-2")
image = optional(string, "linode/ubuntu22.04")
authorized_keys = optional(list(string), [])
authorized_users = optional(list(string), [])
root_pass = optional(string, null)
private_ip = optional(bool, true)
backups_enabled = optional(bool, false)
watchdog_enabled = optional(bool, true)
}), {})
ssh = optional(object({
cloud_compose_keys = optional(list(string), [])
users = optional(map(list(string)), {})
}), {})
volumes = optional(object({
data_size_gb = optional(number, 50)
docker_volumes_size_gb = optional(number, 100)
}), {})
firewall = optional(object({
enabled = optional(bool, true)
ssh_source_ipv4 = optional(list(string), ["0.0.0.0/0"])
ssh_source_ipv6 = optional(list(string), ["::/0"])
web_source_ipv4 = optional(list(string), ["0.0.0.0/0"])
web_source_ipv6 = optional(list(string), ["::/0"])
}), {})
}) | `{}` | no |
-| [runtime](#input\_runtime) | Provider-neutral compose/runtime settings. | object({
rootfs = optional(string, "")
rootfs_archive_url = optional(string, "")
rootfs_archive_sha256 = optional(string, "")
users = optional(map(list(string)), {})
compose = optional(object({
primary = optional(string, "")
ingress_port = optional(number, 80)
ingress = optional(object({
letsencrypt = optional(bool, false)
bot_mitigation = optional(bool, false)
mode = optional(string, "")
domain = optional(string, "")
acme_email = optional(string, "")
trusted_ips = optional(list(string), [])
max_upload_size = optional(string, "")
upload_timeout = optional(string, "")
}), {})
repo = optional(string, "")
branch = optional(string, "main")
projects = optional(map(object({
docker_compose_repo = string
docker_compose_branch = optional(string)
project_dir = optional(string)
compose_project_name = optional(string)
ingress_port = optional(number)
ingress = optional(object({
letsencrypt = optional(bool)
bot_mitigation = optional(bool)
mode = optional(string)
domain = optional(string)
acme_email = optional(string)
trusted_ips = optional(list(string))
max_upload_size = optional(string)
upload_timeout = optional(string)
}), {})
sitectl_context_name = optional(string)
sitectl_plugin = optional(string)
sitectl_environment = optional(string)
sitectl_packages = optional(list(string), [])
sitectl_verify_args = optional(list(string), [])
docker_compose_init = optional(list(string))
docker_compose_up = optional(list(string))
docker_compose_down = optional(list(string))
docker_compose_rollout = optional(list(string))
})), {})
init = optional(list(string), [
"sitectl config set-context \"$${SITECTL_CONTEXT_NAME}\" --type local --project-dir \"$${DOCKER_COMPOSE_DIR}\" --site \"$${CLOUD_COMPOSE_INSTANCE_NAME}\" --plugin \"$${SITECTL_PLUGIN}\" --environment \"$${SITECTL_ENVIRONMENT}\" --project-name \"$${CLOUD_COMPOSE_INSTANCE_NAME}\" --compose-project-name \"$${COMPOSE_PROJECT_NAME}\" --docker-socket /var/run/docker.sock --env-file .env --default"
])
up = optional(list(string), [
"sitectl compose --context \"$${SITECTL_CONTEXT_NAME}\" up -d --remove-orphans",
"sitectl healthcheck --context \"$${SITECTL_CONTEXT_NAME}\" --persist --timeout \"$${SITECTL_HEALTHCHECK_TIMEOUT}\" --interval \"$${SITECTL_HEALTHCHECK_INTERVAL}\"",
"if [ \"$${SITECTL_ENVIRONMENT}\" != \"production\" ]; then sitectl verify --context \"$${SITECTL_CONTEXT_NAME}\" $${SITECTL_VERIFY_ARGS:-}; fi"
])
down = optional(list(string), [
"sitectl compose --context \"$${SITECTL_CONTEXT_NAME}\" down"
])
rollout = optional(list(string), [
"TARGET_REF=\"$${GIT_REF:-$${GIT_BRANCH:-$${DOCKER_COMPOSE_BRANCH:-main}}}\"",
"if [ -x ./scripts/rollout.sh ]; then ./scripts/rollout.sh; else sitectl deploy --context \"$${SITECTL_CONTEXT_NAME}\" --branch \"$TARGET_REF\"; fi",
"sitectl healthcheck --context \"$${SITECTL_CONTEXT_NAME}\" --persist --timeout \"$${SITECTL_HEALTHCHECK_TIMEOUT}\" --interval \"$${SITECTL_HEALTHCHECK_INTERVAL}\"",
"if [ \"$${SITECTL_ENVIRONMENT}\" != \"production\" ]; then sitectl verify --context \"$${SITECTL_CONTEXT_NAME}\" $${SITECTL_VERIFY_ARGS:-}; fi"
])
}), {})
sitectl = optional(object({
packages = optional(list(string), ["sitectl"])
version = optional(string, "latest")
context_name = optional(string, "")
plugin = optional(string, "core")
environment = optional(string, "production")
healthcheck_timeout = optional(string, "10m")
healthcheck_interval = optional(string, "15s")
verify_args = optional(list(string), [])
}), {})
docker = optional(object({
# renovate: datasource=github-releases depName=docker-compose packageName=docker/compose versioning=semver
compose_version = optional(string, "v5.2.0")
# renovate: datasource=github-releases depName=docker-buildx packageName=docker/buildx versioning=semver
buildx_version = optional(string, "v0.35.0")
}), {})
managed_runtime = optional(object({
enabled = optional(bool, true)
internal_services_enabled = optional(bool, true)
internal_services_auto_update = optional(bool, true)
lightsout_image = optional(string, "ghcr.io/libops/lightsout:main")
cap_image = optional(string, "ghcr.io/libops/cap:main")
cadvisor_image = optional(string, "ghcr.io/google/cadvisor:v0.57.0@sha256:e75bdb03b74b0b6995f208f166fead2e6e555dde73e44200113bb26f41b1981d")
artifacts = optional(list(object({
name = string
url = string
sha256 = string
path = string
mode = optional(string, "0755")
owner = optional(string, "root")
group = optional(string, "root")
restart = optional(string, "")
})), [])
}), {})
vault = optional(object({
addr = optional(string, "")
namespace = optional(string, "")
role = optional(string, "")
agent_enabled = optional(bool, false)
auth_method = optional(string, "gcp-iam")
gcp_auth_mount_path = optional(string, "auth/gcp")
agent_token_path = optional(string, "/mnt/disks/data/vault/token")
agent_additional_config = optional(string, "")
agent_templates = optional(list(object({
destination = string
contents = string
perms = optional(string, "0640")
command = optional(string, "")
})), [])
}), {})
extra_env = optional(map(string), {})
}) | `{}` | no |
+| [runtime](#input\_runtime) | Provider-neutral compose/runtime settings. | object({
rootfs = optional(string, "")
rootfs_archive_url = optional(string, "")
rootfs_archive_sha256 = optional(string, "")
users = optional(map(list(string)), {})
compose = optional(object({
primary = optional(string, "")
ingress_port = optional(number, 80)
ingress = optional(object({
letsencrypt = optional(bool, false)
bot_mitigation = optional(bool, false)
mode = optional(string, "")
domain = optional(string, "")
acme_email = optional(string, "")
trusted_ips = optional(list(string), [])
max_upload_size = optional(string, "")
upload_timeout = optional(string, "")
}), {})
repo = optional(string, "")
branch = optional(string, "main")
projects = optional(map(object({
docker_compose_repo = string
docker_compose_branch = optional(string)
project_dir = optional(string)
compose_project_name = optional(string)
ingress_port = optional(number)
ingress = optional(object({
letsencrypt = optional(bool)
bot_mitigation = optional(bool)
mode = optional(string)
domain = optional(string)
acme_email = optional(string)
trusted_ips = optional(list(string))
max_upload_size = optional(string)
upload_timeout = optional(string)
}), {})
sitectl_context_name = optional(string)
sitectl_plugin = optional(string)
sitectl_environment = optional(string)
sitectl_packages = optional(list(string), [])
sitectl_verify_args = optional(list(string), [])
docker_compose_init = optional(list(string))
docker_compose_up = optional(list(string))
docker_compose_down = optional(list(string))
docker_compose_rollout = optional(list(string))
})), {})
init = optional(list(string), [
"sitectl config set-context \"$${SITECTL_CONTEXT_NAME}\" --type local --project-dir \"$${DOCKER_COMPOSE_DIR}\" --site \"$${CLOUD_COMPOSE_INSTANCE_NAME}\" --plugin \"$${SITECTL_PLUGIN}\" --environment \"$${SITECTL_ENVIRONMENT}\" --project-name \"$${CLOUD_COMPOSE_INSTANCE_NAME}\" --compose-project-name \"$${COMPOSE_PROJECT_NAME}\" --docker-socket /var/run/docker.sock --env-file .env --default"
])
up = optional(list(string), [
"sitectl compose --context \"$${SITECTL_CONTEXT_NAME}\" up -d --remove-orphans",
"sitectl healthcheck --context \"$${SITECTL_CONTEXT_NAME}\" --persist --timeout \"$${SITECTL_HEALTHCHECK_TIMEOUT}\" --interval \"$${SITECTL_HEALTHCHECK_INTERVAL}\"",
"if [ \"$${SITECTL_ENVIRONMENT}\" != \"production\" ]; then sitectl verify --context \"$${SITECTL_CONTEXT_NAME}\" $${SITECTL_VERIFY_ARGS:-}; fi"
])
down = optional(list(string), [
"sitectl compose --context \"$${SITECTL_CONTEXT_NAME}\" down"
])
rollout = optional(list(string), [
"TARGET_REF=\"$${GIT_REF:-$${GIT_BRANCH:-$${DOCKER_COMPOSE_BRANCH:-main}}}\"",
"if [ -x ./scripts/rollout.sh ]; then ./scripts/rollout.sh; else sitectl deploy --context \"$${SITECTL_CONTEXT_NAME}\" --branch \"$TARGET_REF\"; fi",
"sitectl healthcheck --context \"$${SITECTL_CONTEXT_NAME}\" --persist --timeout \"$${SITECTL_HEALTHCHECK_TIMEOUT}\" --interval \"$${SITECTL_HEALTHCHECK_INTERVAL}\"",
"if [ \"$${SITECTL_ENVIRONMENT}\" != \"production\" ]; then sitectl verify --context \"$${SITECTL_CONTEXT_NAME}\" $${SITECTL_VERIFY_ARGS:-}; fi"
])
}), {})
sitectl = optional(object({
packages = optional(list(string), ["sitectl"])
version = optional(string, "latest")
context_name = optional(string, "")
plugin = optional(string, "core")
environment = optional(string, "production")
healthcheck_timeout = optional(string, "20m")
healthcheck_interval = optional(string, "15s")
verify_args = optional(list(string), [])
}), {})
docker = optional(object({
# renovate: datasource=github-releases depName=docker-compose packageName=docker/compose versioning=semver
compose_version = optional(string, "v5.2.0")
# renovate: datasource=github-releases depName=docker-buildx packageName=docker/buildx versioning=semver
buildx_version = optional(string, "v0.35.0")
}), {})
managed_runtime = optional(object({
enabled = optional(bool, true)
internal_services_enabled = optional(bool, true)
internal_services_auto_update = optional(bool, true)
lightsout_image = optional(string, "ghcr.io/libops/lightsout:main")
cap_image = optional(string, "ghcr.io/libops/cap:main")
cadvisor_image = optional(string, "ghcr.io/google/cadvisor:v0.57.0@sha256:e75bdb03b74b0b6995f208f166fead2e6e555dde73e44200113bb26f41b1981d")
artifacts = optional(list(object({
name = string
url = string
sha256 = string
path = string
mode = optional(string, "0755")
owner = optional(string, "root")
group = optional(string, "root")
restart = optional(string, "")
})), [])
}), {})
vault = optional(object({
addr = optional(string, "")
namespace = optional(string, "")
role = optional(string, "")
agent_enabled = optional(bool, false)
auth_method = optional(string, "gcp-iam")
gcp_auth_mount_path = optional(string, "auth/gcp")
agent_token_path = optional(string, "/mnt/disks/data/vault/token")
agent_additional_config = optional(string, "")
agent_templates = optional(list(object({
destination = string
contents = string
perms = optional(string, "0640")
command = optional(string, "")
})), [])
}), {})
extra_env = optional(map(string), {})
}) | `{}` | no |
| [template](#input\_template) | Optional compose template preset. Supported values are archivesspace, ojs, isle, drupal, wp, omeka-s, and omeka-classic. Explicit runtime settings override preset defaults. | `string` | `""` | no |
## Outputs
diff --git a/modules/digitalocean/variables.tf b/modules/digitalocean/variables.tf
index a55efe5..4b95ae7 100644
--- a/modules/digitalocean/variables.tf
+++ b/modules/digitalocean/variables.tf
@@ -114,7 +114,7 @@ variable "runtime" {
context_name = optional(string, "")
plugin = optional(string, "core")
environment = optional(string, "production")
- healthcheck_timeout = optional(string, "10m")
+ healthcheck_timeout = optional(string, "20m")
healthcheck_interval = optional(string, "15s")
verify_args = optional(list(string), [])
}), {})
diff --git a/modules/linode/variables.tf b/modules/linode/variables.tf
index c6179fb..efdd15d 100644
--- a/modules/linode/variables.tf
+++ b/modules/linode/variables.tf
@@ -117,7 +117,7 @@ variable "runtime" {
context_name = optional(string, "")
plugin = optional(string, "core")
environment = optional(string, "production")
- healthcheck_timeout = optional(string, "10m")
+ healthcheck_timeout = optional(string, "20m")
healthcheck_interval = optional(string, "15s")
verify_args = optional(list(string), [])
}), {})
diff --git a/variables.tf b/variables.tf
index d2387b0..0d20e19 100644
--- a/variables.tf
+++ b/variables.tf
@@ -287,7 +287,7 @@ variable "runtime" {
context_name = optional(string, "")
plugin = optional(string, "core")
environment = optional(string, "production")
- healthcheck_timeout = optional(string, "10m")
+ healthcheck_timeout = optional(string, "20m")
healthcheck_interval = optional(string, "15s")
verify_args = optional(list(string), [])
}), {})
From 74b894e9365d6d6c7dea7c614723cd197d22b2df Mon Sep 17 00:00:00 2001
From: "H.E. Pennypacker" <115990865+pennypacker-he@users.noreply.github.com>
Date: Sun, 5 Jul 2026 20:43:35 +0000
Subject: [PATCH 7/8] [minor] Tighten smoke bootstrap timeouts
---
ci/cloud-smoke.sh | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/ci/cloud-smoke.sh b/ci/cloud-smoke.sh
index f93bcdf..9ed3a24 100755
--- a/ci/cloud-smoke.sh
+++ b/ci/cloud-smoke.sh
@@ -133,7 +133,7 @@ positive_integer_env() {
}
boot_timeout_seconds() {
- positive_integer_env CLOUD_COMPOSE_SMOKE_BOOT_TIMEOUT 3600
+ positive_integer_env CLOUD_COMPOSE_SMOKE_BOOT_TIMEOUT 1200
}
destroy_timeout_seconds() {
@@ -634,6 +634,9 @@ run_target() (
root="$(target_root "$target")"
target_env "$target"
+ if [[ -z "${CLOUD_COMPOSE_SMOKE_BOOT_TIMEOUT:-}" ]] && [[ "$(target_template "$target")" == "isle" ]]; then
+ export CLOUD_COMPOSE_SMOKE_BOOT_TIMEOUT=1800
+ fi
workdir="$(target_workdir "$target")"
key_path="$workdir/id_ed25519"
From 370d267c86d7ac3a7c583ed8466c3479e356c8d8 Mon Sep 17 00:00:00 2001
From: "H.E. Pennypacker" <115990865+pennypacker-he@users.noreply.github.com>
Date: Sun, 5 Jul 2026 20:47:51 +0000
Subject: [PATCH 8/8] [minor] Run GCP smoke healthcheck on VM
---
ci/cloud-smoke.sh | 25 ++++++++++++++++++++++---
1 file changed, 22 insertions(+), 3 deletions(-)
diff --git a/ci/cloud-smoke.sh b/ci/cloud-smoke.sh
index 9ed3a24..41952cd 100755
--- a/ci/cloud-smoke.sh
+++ b/ci/cloud-smoke.sh
@@ -610,13 +610,32 @@ configure_sitectl_context() {
}
run_healthcheck() {
- local home_dir="$1" output_json="$2"
- local context timeout interval
+ local home_dir="$1" key_path="$2" output_json="$3"
+ local provider context timeout interval
+ provider="$(jq -r '.provider' "$output_json")"
context="$(jq -r '.context_name' "$output_json")"
timeout="$(jq -r '.healthcheck_timeout' "$output_json")"
interval="$(jq -r '.healthcheck_interval' "$output_json")"
+ if [[ "$provider" == "gcp" ]]; then
+ local host port user quoted_context quoted_timeout quoted_interval
+
+ host="$(jq -r '.host' "$output_json")"
+ port="$(jq -r '.ssh_port' "$output_json")"
+ user="$(jq -r '.ssh_user' "$output_json")"
+ quoted_context="$(shell_quote "$context")"
+ quoted_timeout="$(shell_quote "$timeout")"
+ quoted_interval="$(shell_quote "$interval")"
+
+ ssh_cmd "$home_dir" "$key_path" "$host" "$port" "$user" "bash -lc 'set -euo pipefail
+export HOME=/home/cloud-compose
+source /home/cloud-compose/profile.sh
+exec sitectl healthcheck --context ${quoted_context} --persist --timeout ${quoted_timeout} --interval ${quoted_interval} --format table
+'"
+ return
+ fi
+
HOME="$home_dir" sitectl healthcheck \
--context "$context" \
--persist \
@@ -717,7 +736,7 @@ run_target() (
fi
configure_sitectl_context "$home_dir" "$key_path" "$output_json"
- if ! run_healthcheck "$home_dir" "$output_json"; then
+ if ! run_healthcheck "$home_dir" "$key_path" "$output_json"; then
dump_remote_logs "$home_dir" "$key_path" "$host" "$port" "$user" "$project_dir"
return 1
fi