chore(ci): purge legacy docker-compose and certbot scripts, update cloud-init user to adam (#42)

### Summary of Changes - **Legacy Cleanup**: - Deleted `ci/deploy/` (`docker-compose.yml`, `.env.template`, `nginx/`) - Deleted `ci/scripts/deploy-certbot.sh` - Deleted `ci/scripts/deploy-new-tags.sh` - **Cloud-Init Template Updates**: - Replaced username `debian` with `adam` - Removed deprecated `disable: - servicelb` - Cleaned up heredoc YAML formatting
2026-08-23 17:57:48 +03:00
1 parent 3643eca3f7
commit 9e129ccfb8
@@ -18,7 +18,7 @@ ssh_pwauth: false
 # 1. User & SSH Key Configuration (Replace stub with your public SSH key)
 # ------------------------------------------------------------------------------
 users:
-  - name: debian
+  - name: adam
    sudo: ALL=(ALL) NOPASSWD:ALL
    shell: /bin/bash
    ssh_authorized_keys:
@@ -80,8 +80,6 @@ write_files:
    owner: root:root
    permissions: '0600'
    content: |
-      disable:
-        - servicelb
      write-kubeconfig-mode: "0644"

  # ----------------------------------------------------------------------------
@@ -185,36 +183,36 @@ EOF_DNS

      echo "=== [Bootstrap] Applying initial GitOps root sync ==="
      kubectl apply -f - << 'EOF_GITOPS'
-      apiVersion: source.toolkit.fluxcd.io/v1
-      kind: GitRepository
-      metadata:
-        name: ermnvldmr-repo
-        namespace: flux-system
-      spec:
-        interval: 1m
-        url: https://github.com/deytenit/ermnvldmr.com.git
-        ref:
-          branch: next
-      ---
-      apiVersion: kustomize.toolkit.fluxcd.io/v1
-      kind: Kustomization
-      metadata:
-        name: cluster-sync
-        namespace: flux-system
-      spec:
-        interval: 5m
-        sourceRef:
-          kind: GitRepository
-          name: ermnvldmr-repo
-        path: ./ci/k8s/clusters/production
-        prune: true
-        wait: true
-        timeout: 2m
-        decryption:
-          provider: sops
-          secretRef:
-            name: sops-age
-      EOF_GITOPS
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: ermnvldmr-repo
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: https://github.com/deytenit/ermnvldmr.com.git
+  ref:
+    branch: next
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cluster-sync
+  namespace: flux-system
+spec:
+  interval: 5m
+  sourceRef:
+    kind: GitRepository
+    name: ermnvldmr-repo
+  path: ./ci/k8s/clusters/production
+  prune: true
+  wait: true
+  timeout: 2m
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+EOF_GITOPS

      echo "=== [Bootstrap] First-Boot Bootstrap Sequence Complete ==="

@@ -1,6 +0,0 @@
-# Docker Image Tags
-DOCS_TAG=$DOCS_TAG
-WWW_TAG=$WWW_TAG
-
-# Application Settings
-DOMAIN=ermnvldmr.com
@@ -1,61 +0,0 @@
-name: com-ermnvldmr
-
-services:
-  nginx:
-    image: nginx:1.28-alpine
-    container_name: com-ermnvldmr-nginx
-    restart: always
-    ports:
-      - '80:80'
-      - '443:443'
-    volumes:
-      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
-      - ./nginx/conf.d:/etc/nginx/conf.d:ro
-      - /etc/letsencrypt:/etc/letsencrypt:ro
-    networks:
-      - com-ermnvldmr-direct
-      - com-ermnvldmr-enclave
-    deploy:
-      resources:
-        limits:
-          cpus: '0.50'
-          memory: 256M
-    security_opt:
-      - no-new-privileges:true
-
-  docs:
-    image: ghcr.io/deytenit/ermnvldmr.com/docs:${DOCS_TAG}
-    container_name: com-ermnvldmr-docs
-    restart: always
-    networks:
-      - com-ermnvldmr-enclave
-    deploy:
-      resources:
-        limits:
-          cpus: '0.25'
-          memory: 128M
-    security_opt:
-      - no-new-privileges:true
-
-  www:
-    image: ghcr.io/deytenit/ermnvldmr.com/www:${WWW_TAG}
-    container_name: com-ermnvldmr-www
-    restart: always
-    networks:
-      - com-ermnvldmr-enclave
-    deploy:
-      resources:
-        limits:
-          cpus: '0.25'
-          memory: 128M
-    security_opt:
-      - no-new-privileges:true
-
-networks:
-  com-ermnvldmr-direct:
-    name: com-ermnvldmr-direct
-    driver: bridge
-  com-ermnvldmr-enclave:
-    name: com-ermnvldmr-enclave
-    internal: true
-    driver: bridge
@@ -1,41 +0,0 @@
-server {
-    listen 80;
-    server_name docs.ermnvldmr.com;
-
-    location /.well-known/acme-challenge/ {
-        root /var/www/certbot;
-    }
-
-    location / {
-        return 301 https://$host$request_uri;
-    }
-}
-
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name docs.ermnvldmr.com;
-
-    ssl_certificate     /etc/letsencrypt/live/docs.ermnvldmr.com/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/docs.ermnvldmr.com/privkey.pem;
-
-    # Optimized SSL settings
-    ssl_session_timeout 1d;
-    ssl_session_cache shared:SSL:50m;
-    ssl_session_tickets off;
-    ssl_protocols TLSv1.2 TLSv1.3;
-    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
-    ssl_prefer_server_ciphers off;
-
-    # HSTS
-    add_header Strict-Transport-Security "max-age=63072000" always;
-
-    location / {
-        proxy_pass http://com-ermnvldmr-docs:80;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-}
@@ -1,41 +0,0 @@
-server {
-    listen 80;
-    server_name www.ermnvldmr.com;
-
-    location /.well-known/acme-challenge/ {
-        root /var/www/certbot;
-    }
-
-    location / {
-        return 301 https://$host$request_uri;
-    }
-}
-
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name www.ermnvldmr.com;
-
-    ssl_certificate     /etc/letsencrypt/live/www.ermnvldmr.com/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/www.ermnvldmr.com/privkey.pem;
-
-    # Optimized SSL settings
-    ssl_session_timeout 1d;
-    ssl_session_cache shared:SSL:50m;
-    ssl_session_tickets off;
-    ssl_protocols TLSv1.2 TLSv1.3;
-    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
-    ssl_prefer_server_ciphers off;
-
-    # HSTS
-    add_header Strict-Transport-Security "max-age=63072000" always;
-
-    location / {
-        proxy_pass http://com-ermnvldmr-www:80;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-}
@@ -1,30 +0,0 @@
-user nginx;
-worker_processes auto;
-error_log /var/log/nginx/error.log warn;
-pid /var/run/nginx.pid;
-
-events {
-    worker_connections 1024;
-}
-
-http {
-    include /etc/nginx/mime.types;
-    default_type application/octet-stream;
-
-    # Optimization
-    sendfile on;
-    tcp_nopush on;
-    tcp_nodelay on;
-    keepalive_timeout 65;
-    types_hash_max_size 2048;
-    server_tokens off;
-
-    # Security Headers
-    add_header X-Frame-Options "SAMEORIGIN" always;
-    add_header X-XSS-Protection "1; mode=block" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header Referrer-Policy "no-referrer-when-downgrade" always;
-    add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
-
-    include /etc/nginx/conf.d/*.conf;
-}
@@ -1,42 +0,0 @@
-#!/bin/bash
-set -e
-
-# Usage: ./deploy-certbot.sh [domain1] [domain2] ...
-EMAIL="personal@ermnvldmr.com"
-CLOUDFLARE_INI="/etc/letsencrypt/cloudflare.ini"
-
-# Collect domains from arguments, fallback to default if none provided
-if [ $# -eq 0 ]; then
-    DOMAINS=("docs.ermnvldmr.com")
-else
-    DOMAINS=("$@")
-fi
-
-# Build domain arguments for certbot
-DOMAIN_ARGS=()
-for d in "${DOMAINS[@]}"; do
-    DOMAIN_ARGS+=("-d" "$d")
-done
-
-echo "Installing certbot and Cloudflare DNS plugin..."
-sudo apt-get update
-sudo apt-get install -y certbot python3-certbot-cloudflare
-
-if [ ! -f "$CLOUDFLARE_INI" ]; then
-    echo "Error: Cloudflare credentials file not found at $CLOUDFLARE_INI"
-    echo "Please ensure it exists and has 600 permissions."
-    exit 1
-fi
-
-echo "Requesting certificate for ${DOMAINS[*]} via Cloudflare DNS challenge..."
-sudo certbot certonly \
-  --dns-cloudflare \
-  --dns-cloudflare-credentials "$CLOUDFLARE_INI" \
-  "${DOMAIN_ARGS[@]}" \
-  --email "$EMAIL" \
-  --agree-tos \
-  --no-eff-email \
-  --non-interactive
-
-echo "Certificates for ${DOMAINS[*]} have been processed."
-
@@ -1,47 +0,0 @@
-#!/bin/bash
-set -e
-
-# Setup paths relative to the script location
-DEPLOY_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../deploy" && pwd)"
-ENV_FILE="$DEPLOY_DIR/.env"
-TEMPLATE_FILE="$DEPLOY_DIR/.env.template"
-
-echo "Starting deployment for com-ermnvldmr..."
-
-# 1. Load existing .env values as defaults (do NOT overwrite environment variables)
-if [ -f "$ENV_FILE" ]; then
-    while IFS= read -r line || [ -n "$line" ]; do
-        # Skip comments and empty lines
-        [[ "$line" =~ ^# ]] || [[ -z "$line" ]] && continue
-        
-        key="${line%%=*}"
-        val="${line#*=}"
-        
-        # Only export if the variable is not already set in the environment
-        if [ -z "${!key}" ]; then
-            export "$key"="$val"
-        fi
-    done < "$ENV_FILE"
-fi
-
-# 2. Apply final fallback defaults
-export DOCS_TAG="${DOCS_TAG:-latest}"
-export WWW_TAG="${WWW_TAG:-latest}"
-
-# 3. Generate the .env file from template
-# Explicitly list variables to substitute to avoid messing with other values
-echo "Generating .env from template..."
-envsubst '$DOCS_TAG $WWW_TAG' < "$TEMPLATE_FILE" > "$ENV_FILE"
-
-# 4. Run Docker operations
-cd "$DEPLOY_DIR"
-echo "Pulling images..."
-docker compose pull
-
-echo "Starting containers..."
-docker compose up -d --remove-orphans
-
-echo "Pruning unused images..."
-docker image prune -f
-
-echo "Deployment complete."