Merge pull request #40 from binplz/jmc/dns

Elastic IP and automatic DNS updates

Author: jonascarpay

deploy/.terraform.lock.hcl

@@ -43,8 +43,22 @@ chmod 0600 /root/nixbuild.pem
 EOF
 }
 
-output "server_ip_addr" {
-  value = aws_instance.binplz_server.public_ip
+output "public_ip_addr" {
+  value = aws_eip.binplz_eip.public_ip
+}
+
+resource "aws_eip" "binplz_eip" {
+  instance = aws_instance.binplz_server.id
+}
+
+resource "null_resource" "dns_update" {
+  triggers = {
+    # Note that after deploying binplz at least once, we will likely never re-provision this Elastic IP, so it is very unlikely to ever change. 
+    ip_change = aws_eip.binplz_eip.public_ip
+  }
+  provisioner "local-exec" {
+    command = "python update_dns.py ${aws_eip.binplz_eip.public_ip}"
+  }
 }
 
 resource "aws_security_group" "my_security_group" {

deploy/main.tf

@@ -0,0 +1,87 @@
+"""Binplz DNS update script
+
+Usage: python update_dns.py <root IP address>
+
+Where <root IP address> is the IP address that the A record for the binplz.dev root domain should point to.
+
+This script talks to the transip API to update the binplz.dev settings.
+To do so, we
+  1. Request an API token, signing the request with our transip account's private key
+  2. Request a DNS record update, passing the API token
+"""
+import random
+import requests
+import json
+import datetime
+import base64
+import OpenSSL.crypto as ssl
+import sys
+import ipaddress
+
+ip = ipaddress.ip_address(sys.argv[1])
+
+# API docs: https://api.transip.nl/rest/docs.html
+api_root = "https://api.transip.nl/v6"
+username = "jonascarpay"
+
+print(f"Starting update of DNS record to {ip}...")
+
+print("Preparing and signing Token request...")
+
+timestamp: str = datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S")
+token_request_body = {
+    "login": username,
+    "nonce": str(random.randint(0, 999999999)),
+    "read_only": False,
+    "expiration_time": "30 minutes",
+    "label": f"Binplz DNS update key {timestamp}",
+    "global_key": True,
+}
+token_request_body_ascii = json.dumps(token_request_body).encode("ascii")
+
+with open("../secrets/plaintext/transip_key.pem", "r") as f:
+    private_key: str = f.read().strip()
+
+signature = ssl.sign(
+    pkey=ssl.load_privatekey(ssl.FILETYPE_PEM, private_key),
+    data=token_request_body_ascii,
+    digest="sha512",
+)
+
+print("Requesting new API token...")
+token_response = requests.post(
+    url=api_root + "/auth",
+    data=token_request_body_ascii,
+    headers={"Signature": base64.b64encode(signature).decode("ascii")},
+)
+
+assert token_response.status_code == 201
+
+token = token_response.json()["token"]
+
+dns_update_request_body = {
+    "dnsEntries": [
+        {
+            "name": "@",
+            "expire": 86400,  # 1 day
+            "type": "A",
+            "content": str(ip),
+        },
+        {
+            "name": "docs",
+            "expire": 86400,
+            "type": "CNAME",
+            "content": "binplz.github.io.",
+        },
+    ]
+}
+
+print("Updating DNS Entries...")
+dns_update_response = requests.put(
+    url=api_root + "/domains/binplz.dev/dns",
+    data=json.dumps(dns_update_request_body),
+    headers={"Authorization": f"Bearer {token}"},
+)
+
+assert dns_update_response.status_code == 204
+print("Success!")

deploy/update_dns.py

@@ -159,6 +159,11 @@
           pkgs.rlwrap
           pkgs.sqlite
           pkgs.age
+
+          (pkgs.python3.withPackages (p: [
+            p.pyopenssl
+            p.requests
+          ]))
         ];
         TF_VAR_binplz_ami_path = "${inputs.self.packages.${system}.server-ami}/${image-name}.vhd";
         # Image name on AWS. The purpose is to invalidate when the image contents change.

flake.nix

@@ -1,81 +1,37 @@
 age-encryption.org/v1
 -> ssh-rsa HFk/YQ
-DwzfyX0GKSdhaWPe+86a3BlmSKKMLt9b3c1OyJ3U6iqxrV3+tT8lIsbMWBiAIip6
-nxTgg/gyLYhOlgX5E/cpMAcfsWJ43BjPZ8NcLNYBmoTYFSIDG6w3G0iwKdBf2dDA
-atQKAp4Jy1AC05Km5EwtwQm2b0ou4POpaXGHJIaUUAh4SzPOm+FA5C1XKt/8rQXh
-YiaJCmYCf8LftaAdAhfdysTkRK7HnpsTaw13jsQNq88dOVZWjuha8LWPGDockvl8
-1kuhDdguTAbD/DM3epO34uE76BBh89+fyFj1Usi8NdNJJ4isl4IeTPnKD6oK88VJ
-gHsMhAdwgj0zpORR/IYENQ6LdRE2rGIK4Fh6r980Sr+3wKzHPuIfNll+PmEYBY90
-q6bxfMVCm/IN15Gi2BRqJIsUG9nCg1s/5BJnEyUN2xsbfcLPkZDkBQhJ0XSP4IKo
-Exorpj05Fua4xZWLYV4OwE1fa7Q6lw8VsPDR5cYb/cuAJ0URRXSyOf4Dvu060MW9
-1cOQC9TT50VQnO2/8urq9CTTtTm7Te7TbX+ZBIGeK+wfVsSeGftrYAyyfgWQtnDb
-vo5UFdT0xE+2QXMvQ96JbA2tNSj/wechXG2Nt4ESCfKr0xmsnEDt62PBhKrqDtMr
-rs/ZhgUOFCPw9RAg+iUIAPdYgBgmvY2niAsq4RrnKFM
--> ssh-rsa LQjD8A
-LfzwH65cwgTOn5Mce5pyYsXX3gmOJRMh8iaogp9tFUdNbbaiBfnVzdzkD3lD43rp
-teqlDZT3ouNd7B3NCyAwK3dL352lgE9E5cGyvQowbExzqAPaCRTOEMjzokylQGFF
-7OuBWsxQEriaKJzQqwUIWjI6P+9wemn5GDTQDiZH5U3mCNwgsU27W6um8Jsxq4ji
-XcODNqpp1EPcAapXpg4JyPJFc9GRmDIlK3vablJBcxakf6gi6ELK8fGF65b33IC4
-+7jWMaV9V5Ib/K0GiFTTKk+HieMOn1nBHSIVJSAsdLFFuMEXaPn9XOCoEmAM3IFS
-qieoXjx2ztWaIbR/DPCF2/tq5OB5xEXZmde3XGDn0DSkhj3hJ5mYkIPmxT11/fZO
-KSFVGTOMY5ErbPo3ubRgJxT0DbJlYxFSX0zIYykGfuoHXXoYgm3dLe6IFMN9DxCy
-DG/bm7Z4zpvXEWpxGRq6N5NAKrkwGS1K51rKuFRp3mkjln86eR3pozZQYKKbyyuP
-27YLuIxo0vjIT7WL3fLyF1+ZFd67hs8+qLCUk0e8VL+75wIIXSjZSrAmt/cwq9Gi
-OhzKSeFzGomrKhDcTNsBeLaXl6fzpTv9FhCwSJGKJ8pnpScqhf+f6Kpi4/W2PwV8
-wAWRZKe/WQCDHeAl+UfuQrSNjBKJaw8tYGMVShIJ91s
--> ssh-rsa trQevA
-WoZoDZAhW/wulhAFDPl9ruix9+vtsI8NaBtYpWxTHKpk5avThziqY3AxrTaIhea+
-rGanOwfoG66gLFD1ZGm5ZWnPATsKPg5AFFGGB9GKPX+Yv0espNRVtjkjo9Ur8A6K
-TnCJYQ4+O9JdnDavsl+yAAwxOTgjp788LuAdL048qab+YTnHJkGXvMSUn1/fEQpq
-u2vQfCJCwhA4Ej4lI8URUrDlP5lI8ZZL3GVQro1Ij1qc3w82WG9DSYiOYY877eyf
-qcY2NnNXJzD8WPhGBCCU2Wrfu3U+yMdlTjAED3mxq6nxw5kZ0AzERIZSOUccjxrz
-nbyg9l83Y2Z2ei52iZ3AmsplVGFOgmjLOfjouFix38827kt5XThE7+SvIsWylFi6
-cegM00H5bdLRvSsSD+EkbEv9uzf9szNo0ImYahh+tZFmv4MUvRaL8qltJPCJa4Qw
-3PZGoMAsidITQ89YzcjrTxJT1cNuFN3XZAQtufJfBUBMsU3y+x8OmSLEHv1bKsuu
-5gSyP3Tn0bdMGbbGMoY4sSRvwI7POU+Y1O7wcCyDwledLF7d/5OIZZgxkiBQ6Jec
-5cFUjaqjZMaRZLbIDYZCr6XwL3bB/61Jw7i3qP7fMVOP6Lpqvbyr+6Q5kO3ijhP2
-aa10g6Jb7J2P/Ysf2pzzO993q6UhqA92ArBI60jmGtU
+kEfgMP3rgqDJ/ELiCaHBt5wnFbdAbwBFy/Be9AdTfYq8NucYUifgGZVRXizDx5OK
+whO+kfqTGmRUWD7po4t+WAXnwZNxjSOh/QeV4UOlZiB02z37hzYbaV2gFB76jmWi
+sfgpN9Nph3nrFOtHXnqJ6xL5I9s5faQywexMi7A6q+qfUKC+Bxxyj9SAnPijQUvo
+8iAEe1zrsk8sjkqmDXZ1SUWc0Vcog1TK6Ty0KCAyME1n0Aczd/NwM05cxtFR8lKH
+R196ogzsJB/y6wqgaEOMieHVr4j56J6ziK10z0KQcVMklcGXuAp1WqzECsozvP/Y
+5Xcy7wWkG/PKySZ2Bh5SJ+ZUd2hvvg4D3KGI8eAr7EksmeaUQ3FeJUiLOSszcHnB
+kAuRy9Hob3Zs1iJz7N60PeirKWFBqoG2t5o2o4m6450ew53JGSjxQvaamsFXDJsc
+UnRZwx48SjaI86P9OjEiUxbvgCn5VqGDsPWYk+n7Fh9vSdT77e6eIHr8FM0o5XTW
+wxowwKDuC80s6oHm5oHqLjRMoQUphNDzWJ4fSnDo8a+DazsfAheKDcoQY1eBuGcL
+btJATtdMvdmADD5M00AGd0ONGGsOvkwYQdW0zmukhMFlow3PP+ka4Por8YBelCWZ
+Qgpa2AkWiRwpk77pFGelzd4/MhKdNhJm1/JYshqPwF8
 -> ssh-rsa 43vRYw
-Ta+xiaWeMIXzV1VbB3Ylxbn6uqd0IMUBsDIXCgJ0eGeqXHzmhqtM183n9She/tbw
-5/50UlIM44YURNd7GSDAwItJvBtFTR+WV7PIRBnPaKpsH6L5QIQmNsuwHMfrD0bo
-qlK9MhXeh21U2YWnpVGNS0dyabGXcjRnz33p9pweIJb+jI92QuBZE0lANJVTZOpP
-i9JTO49G48Ahj35UTxqgHFa1p0Zg2RR7IynKylcMi0CfOYUegSjOGjbHXFKMqH09
-G4HGDB+auUwxv7P/hvNhn8lAJN2ROsDoO5YXx56xRiUDhcTDt1PSolIs8S8It8nF
-ZYLMXPcYrapq7Mq+YeRLnq/2LfQUa7tvtylsNa0i3u9oQeApINhlpi/R0Ppyvzl/
-Nqh+aVkXkzGoBbnGtYjs7dxv8zDoscp7ccQSAjWN3sSDoS3CjadBNqu+aU1drMyp
-ZJL8ztsoLu4dJfTebvmIq+F0gxS7wyDBlW0zmfZTb9mI/Y/3VWbJxsalNrnGVqAJ
-3PPMs53mxgrSLxNH24/4Tw9CAWXHf5kAQsDgFbhv8F1H1V2RBtLi9MKZomOxuIsa
-pDBLbHKSfsBRmLx/aApvIapvJRCnF381PoBV+8k+d9KaXS6I0ixc3vwbUyF86SUi
-FpYpuM3a/g2Tb6U6ABRnS01QH8B6BFcZ1oSXOfExjSY
--> ssh-ed25519 8K5cMg vg36Nr0v41XnBXO4Ud68NrIBtv7Vb+ZHe/wZ0n+25gs
-MHUNjfEYpMXMNf27aktzERWKUCoEme+yuKWm3MVrlIc
--> ssh-rsa lJgVkA
-czcCI5LPmjYXc0GGoCQwZ/25zT6dgXXihnOu3ymDUgwHJ30bHP5eDEpbRQS/38q2
-8wHbB+DoaeKBFpmsJMNY/b5zCKMGdrHIjf0N0ChJAz1SYiQa2/3fWwhVUOVF+hU4
-lHBD06PUOn+MWB8acOdK0QVbARLwvODPYojk0YCPCHOQJT3EG3lAuDjxItlI5okD
-tHM0J3rs8RtGwhNcHA8zPjAxpRhoG6DXDuj8LPybwkapQpYm+2aF8053gwpLRJab
-n4jC43KF5h7wkVftfbkrEg1x6pbz21R65yYW2R8FmnkQ+YCNsbqWYS4CH/gF+N1X
-6mSFWnutLZu6JhPXRrqXrg
+RWb3vXyDvfq3ImWnMmvkXwn/CXgy9ec8a0ixPPRfjGY82DYUYPCgHiLIGnrUUEU9
+hv8kU1IZ9OODKbiF321W/O0Y2eqM5B9spvBxEG1g9qUc1vCNsPCWrjcFgI3+NHOQ
+rkQb9HH/YQxi/4/vB+VPVr7Q1+9Z0Qzyh/2bofNHaS3JxmcFpuMhHi+8enHTS7/P
+gZ6WjW4W2p9t3DkQB5cX/MGxQVdIpIl83cl7mCfypz2EzZ87oNcILd5DPv210PDV
+kNZJs55oNNQ4u9oHn65/TAZhXxqFUr6CLix11brAIK/ZMBMwN8UOoLLEJ6xb2Mmr
+WvJGm6Ak6WvaCNUjfTwq8wu7LjHf/+fdgdoU2ygHmQB/bkm5znVuYydyO4g3Wgqi
+QKHXSv7FImN354IJvpwHjWxO4rhEDUB6brpRDZk6nb8f4IZr5S7n+KPV2LY4L1Z6
+rCOjTd1XzkSSW1NaXK8kw/AL0u85V0s9pkMS1DWEWlsxS+nI6BbbCKg5VBkf2rfI
+UqeQ21T3ecnTYQipbm8wB7a9ZOCNr8YSGgDmUSjPaG9WibgtSPJw9k05LsOjlVy1
+aGEw6Rex4sFECP4/KZNm8xNW1RSnU9rbvTYdMPcA6kjiFnvjs+EKcvI6v1JpufaU
+AgVeLAPal0jFC2fejR5qDkBnLK4U00iTi33emnVHARw
 -> ssh-rsa puikOQ
-kjVVIahUb1LCtnLfo5DggoTWcMXUw+VdVlNKtBr1hbMUkpPZHnHq0A1VjEQCZpG6
-/A9/GT6chbLfnkL7iAGf96MK5zP60qPu981poV2xvL6p3fd6FpJxYtquPx4ik4Zj
-LpajO171toGl7KkzntgFD4w9zJwuJOEC6lrPNDZurC8bkRgrI7l/0WCSixbh2ojt
-RZmjAkZPTqMtgE21Kj0Yzy21GbiaQRY9rQZTwzZcw/iWFjyp/44xIuBixxpaODul
-TkVlp1YWzI28ouEnrMiKu+cC/7ta7GlpTBYXL5i+J5eZQdwIYpMonOnKi2ebpNtg
-eIO9+hNeLtj7eD+KD5jUJ4ciF3j9eedJyb+ONdZEYSz50BPy6chSq4t/0VABW5EL
-Fu11rHOoNKIV/rpbJiO04zPKB2xJO5RemTuLdAiCebIohhJg/wIC8uGwr94JYAn5
-jkv4mMbHPi46dLP0D/Glb8ISSpwoUB1ujWXxym/aRZVnKZw2IMUMLDSzTOhImss2
+BxtFi4Bz0saBe+oNnG8u5n1jrbQJyOM4TuxQxkz/UTTuko24msoB5gwj3KOv5Ulq
+1TR1rU/sYOCabIr97bFM16Aw+v87O8FY70TRZKmRse7WSc/dl2oep8iH4E2ws3dF
+1AeTKJlekTXPvhqr4+jsRW9VlxXSgTTYuTQqf5bvnmwVlamBtSE9ZNNgktnuXd6R
+AtIiH+BYM4QVSZ116EzCeQOP/z7i+i397VxUuH4YNsoOUhKYp62OeNbBHcQMaEap
+twwH4CCx8VEV0hQeauGVDdlQ96JiM6I7deCXRaUjbpFhVVjORsBUhuFqllsw3scd
+79Fi7eES1I+HiK5qlztRTztQD/uaIbJ+msdWg5j8x2UwLQWQlwxONQRj4kd0yiXg
++ckfDSRoMIgkEOq1RmySh2SRcwY1C9vzR02tw2oIkDduaUYjBSnHpiRcgObYXxSr
+sF+APb2jJwHvTXen7TpLr7GbfC76DefEQ4XltJVesbHcQOYHAA2DoLxB2tfMI39H
 
--> ssh-rsa SmsMKw
-TFBLpCQeXHEdp82MU9H1pJyWvEtRgRwSnljXpLgNVnhWE+qEqGPdj0n8bnp7op4L
-yw80edZd0mXG53Rhsw4rfDDAnx54QeBC/KemiYysBjxPc210qrX5V8XJcyMLyugp
-R/529VDp0gjp4EypCd403dVF9kzjFHHR2644nFjbl/DBV+mEPsyNRs1/Czrkbeqr
-L3r0I3GQBeETh0KWNJQYrPU62cVRRhVbl3koA/FD2wyM9ebk4VrIRZMu9KJ7F2Ts
-t66FEBwnXPnnhvrZCzVO/R5B0Obn/s2rLhgTE24h4rLW6nqBsCSLUQuB6yFo7vb+
-adQNvG8CHJvb93JjqZCrSyVp2GvyrcYquTw4m+7VVZJRdZGtzjIWKehoazzIITks
-/2pFwhGdp6L5VMceDrl++UCm1Xt7l+U8le8gMiUlZp+NUJGpjcTnueX81iuuP4aF
-vDU/7InHOAIhKJCnBVXvciWBK+kr7uZpyOFzd4fZlz1jRuotXmowAsVbhz9s6gzi
-
---- 9/GA0HcgMlwbIqz9zSLUJ5qTXK3LRVIwIAoeFg7MYjE
-��!үxzlˊ�y|�a4Dwbښ�Q��)CN�����ܻ�ҹ�ꊾ=�*�b��\,���V'�Y+�E~v�kH�1�UQ����<�@N�zg¡���Y| }q��fʌ��=��b���9���G
-I�8���A����O
+--- cKCGLz95aR1gJv8UoQI2EYQBdZEPrY7b+tFdOlE8wn4
+"��^(mw�^&���J�s�ZD��gP����+|��!Q�g�u����SY�(v�`W�0S�r�B��3�˹gJ�}r!X�*������B�: >M��9\�n��g0̼	��ᙈ(M�4O	ѭ���E����k�Ӯ�Ѕ