Skip to content

Commit a5732d1

Browse files
xnotoxnoto
authored
feat: Initial commit (#1)
* feat: Initial commit * fix: cleanup tunnels
1 parent a280cc6 commit a5732d1

13 files changed

Lines changed: 293 additions & 0 deletions

File tree

‎.checkov.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
block-list-secret-scan: []
2+
compact: true
3+
directory:
4+
- .
5+
download-external-modules: false
6+
evaluate-variables: true
7+
framework:
8+
- all
9+
output:
10+
- cli
11+
quiet: true
12+
soft-fail: true
13+
summary-position: top

‎.github/workflows/opentofu.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: OpenTofu
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
push:
8+
branches:
9+
- main
10+
11+
permissions:
12+
contents: read
13+
pull-requests: write
14+
15+
jobs:
16+
opentofu:
17+
uses: makeitworkcloud/shared-workflows/.github/workflows/opentofu.yml@main
18+
secrets:
19+
SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}

‎.gitignore‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# vim swap files
2+
**/*.sw[po]
3+
4+
# don't commit terraform state or lock. the repo code is the only state we care about.
5+
# the provider state cache is auto-upgraded by default to ensure compatibility with upstream cloud provider APIs
6+
**/.terraform.lock.hcl
7+
**/.terraform
8+
9+
# IDE Folders
10+
**/.vscode
11+
12+
# Mac Finder cache
13+
**/.DS_Store
14+
15+
# Plan output
16+
plan-output.txt

‎.pre-commit-config.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
repos:
2+
- repo: https://github.com/pre-commit/pre-commit-hooks
3+
rev: v6.0.0
4+
hooks:
5+
- id: check-case-conflict
6+
- id: check-merge-conflict
7+
- id: check-symlinks
8+
- id: check-vcs-permalinks
9+
- id: destroyed-symlinks
10+
- id: detect-private-key
11+
- id: mixed-line-ending
12+
- id: trailing-whitespace
13+
- repo: https://github.com/antonbabenko/pre-commit-terraform
14+
rev: v1.104.0
15+
hooks:
16+
- id: terraform_validate
17+
args:
18+
- --hook-config=--retry-once-with-cleanup=true
19+
- --args=-no-color
20+
- --tf-init-args=-reconfigure
21+
- --tf-init-args=-upgrade
22+
- id: terraform_tflint
23+
args:
24+
- --args=--minimum-failure-severity=error
25+
- --args=--config=__GIT_WORKING_DIR__/.tflint.hcl
26+
- id: terraform_checkov
27+
args:
28+
- --args=--config-file __GIT_WORKING_DIR__/.checkov.yml
29+
- id: terraform_fmt
30+
args:
31+
- --args=-no-color
32+
- --args=-diff
33+
- --args=-recursive
34+
- id: terraform_docs
35+
args:
36+
- --args=--config=.terraform-docs.yml

‎.sops.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
---
2+
creation_rules:
3+
- age: age152ek83tm4fj5u70r3fecytn4kg7c5xca24erjchxexx4pfqg6das7q763l

‎.terraform-docs.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
formatter: "markdown"
2+
3+
output:
4+
file: "README.md"
5+
mode: replace
6+
7+
settings:
8+
color: false
9+
lockfile: false
10+
11+
sort:
12+
enabled: true
13+
by: name
14+
15+
# recursive can't be enabled until this bug is fixed:
16+
# https://github.com/terraform-docs/terraform-docs/issues/654
17+
recursive:
18+
enabled: false

‎.tflint.hcl‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
plugin "terraform" {
2+
enabled = true
3+
preset = "recommended"
4+
}
5+
6+
rule "terraform_required_providers" {
7+
enabled = false
8+
}
9+
10+
rule "terraform_required_version" {
11+
enabled = false
12+
}

‎Makefile‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
SHELL := /bin/bash
2+
TERRAFORM := $(shell which tofu)
3+
S3_REGION := $(shell sops decrypt secrets/secrets.yaml | grep ^s3_region | cut -d ' ' -f 2)
4+
S3_BUCKET := $(shell sops decrypt secrets/secrets.yaml | grep ^s3_bucket | cut -d ' ' -f 2)
5+
S3_KEY := $(shell sops decrypt secrets/secrets.yaml | grep ^s3_key | cut -d ' ' -f 2)
6+
S3_ACCESS_KEY := $(shell sops decrypt secrets/secrets.yaml | grep ^s3_access_key | cut -d ' ' -f 2)
7+
S3_SECRET_KEY := $(shell sops decrypt secrets/secrets.yaml | grep ^s3_secret_key | cut -d ' ' -f 2)
8+
9+
.PHONY: help init plan apply migrate test pre-commit-check-deps pre-commit-install-hooks argcd-login
10+
11+
help:
12+
@echo "General targets"
13+
@echo "----------------"
14+
@echo
15+
@echo "\thelp: show this help text"
16+
@echo "\tclean: removes all .terraform directories"
17+
@echo
18+
@echo "Terraform targets"
19+
@echo "-----------------"
20+
@echo
21+
@echo "\tinit: run 'terraform init'"
22+
@echo "\ttest: run pre-commmit checks"
23+
@echo "\tplan: run 'terraform plan'"
24+
@echo "\tapply: run 'terraform apply'"
25+
@echo "\tmigrate; run terraform init -migrate-state"
26+
@echo
27+
@echo "One-time repo init targets"
28+
@echo "--------------------------"
29+
@echo
30+
@echo "\tpre-commit-install-hooks: install pre-commit hooks"
31+
@echo "\tpre-commit-check-deps: check pre-commit dependencies"
32+
@echo
33+
34+
clean:
35+
@find . -name .terraform -type d | xargs -I {} rm -rf {}
36+
37+
init: clean .terraform/terraform.tfstate
38+
39+
.terraform/terraform.tfstate:
40+
@${TERRAFORM} init -reconfigure -upgrade -input=false -backend-config="key=${S3_KEY}" -backend-config="bucket=${S3_BUCKET}" -backend-config="region=${S3_REGION}" -backend-config="access_key=${S3_ACCESS_KEY}" -backend-config="secret_key=${S3_SECRET_KEY}"
41+
42+
plan: init .terraform/plan
43+
44+
.terraform/plan:
45+
@${TERRAFORM} plan -compact-warnings -no-color -out tfplan.bin
46+
@${TERRAFORM} show -no-color tfplan.bin | tee plan-output.txt
47+
@rm -f tfplan.bin
48+
49+
apply: init .terraform/apply
50+
51+
.terraform/apply:
52+
@${TERRAFORM} apply -auto-approve -compact-warnings
53+
54+
migrate:
55+
@echo "First use -make init- using the old S3 backend, then run -make migrate- to use the new one."
56+
@${TERRAFORM} init -migrate-state -backend-config="key=${S3_KEY}" -backend-config="bucket=${S3_BUCKET}" -backend-config="region=${S3_REGION}" -backend-config="access_key=${S3_ACCESS_KEY}" -backend-config="secret_key=${S3_SECRET_KEY}"
57+
58+
test: .git/hooks/pre-commit
59+
@pre-commit run -a
60+
61+
DEPS_PRE_COMMIT=$(shell which pre-commit || echo "pre-commit not found")
62+
DEPS_TERRAFORM_DOCS=$(shell which terraform-docs || echo "terraform-docs not found")
63+
DEPS_TFLINT=$(shell which tflint || echo "tflint not found,")
64+
DEPS_CHECKOV=$(shell which checkov || echo "checkov not found,")
65+
DEPS_JQ=$(shell which jq || echo "jq not found,")
66+
pre-commit-check-deps:
67+
@echo "Checking for pre-commit and its dependencies:"
68+
@echo " pre-commit: ${DEPS_PRE_COMMIT}"
69+
@echo " terraform-docs: ${DEPS_TERRAFORM_DOCS}"
70+
@echo " tflint: ${DEPS_TFLINT}"
71+
@echo " checkov: ${DEPS_CHECKOV}"
72+
@echo " jq: ${DEPS_JQ}"
73+
@echo ""
74+
75+
pre-commit-install-hooks: .git/hooks/pre-commit
76+
77+
.git/hooks/pre-commit: pre-commit-check-deps
78+
@pre-commit install --install-hooks

‎cf-dns.tf‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
resource "cloudflare_dns_record" "root" {
2+
zone_id = local.zone_id
3+
type = "CNAME"
4+
name = "@"
5+
content = "makeitwork.cloud.s3-website.us-west-2.amazonaws.com"
6+
proxied = true
7+
ttl = 1
8+
}
9+
10+
resource "cloudflare_dns_record" "www" {
11+
zone_id = local.zone_id
12+
type = "CNAME"
13+
name = "www"
14+
content = "makeitwork.cloud.s3-website.us-west-2.amazonaws.com"
15+
proxied = true
16+
ttl = 1
17+
}
18+
19+
resource "cloudflare_dns_record" "mx_primary" {
20+
zone_id = local.zone_id
21+
type = "MX"
22+
name = "@"
23+
content = "mx1.privateemail.com"
24+
priority = 10
25+
ttl = 1
26+
}
27+
28+
resource "cloudflare_dns_record" "mx_secondary" {
29+
zone_id = local.zone_id
30+
type = "MX"
31+
name = "@"
32+
content = "mx2.privateemail.com"
33+
priority = 20
34+
ttl = 1
35+
}
36+
37+
resource "cloudflare_dns_record" "spf" {
38+
zone_id = local.zone_id
39+
type = "TXT"
40+
name = "@"
41+
content = "v=spf1 include:spf.privateemail.com ~all"
42+
ttl = 1
43+
}

‎main.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
data "sops_file" "secret_vars" {
2+
source_file = "${path.module}/secrets/secrets.yaml"
3+
}
4+
5+
locals {
6+
account_id = data.sops_file.secret_vars.data["cloudflare_account_id"]
7+
zone_id = data.sops_file.secret_vars.data["cloudflare_zone_id"]
8+
}
9+
10+
data "cloudflare_zone" "makeitwork_cloud" {
11+
zone_id = local.zone_id
12+
}

0 commit comments

Comments
 (0)