quire
change wquoysuunzmnoruqxxnllxkmqmvzuwky
commit 46a83027ad8cf18a99a159eda55e51c1a15a48b2
author Alpha Chen <alpha@kejadlen.dev>
date
parent rykzvtrq
diff --git a/dns.tf b/dns.tf
index fb058d9..795e7f8 100644
--- a/dns.tf
+++ b/dns.tf
@@ -35,6 +35,7 @@ resource "dnsimple_zone_record" "kejadlen_dev_subdomains" {
     git     = local.lotus_land_story.ip_address
     grafana = local.lotus_land_story.ip_address
     hey     = local.lotus_land_story.ip_address
+    quire   = local.lotus_land_story.ip_address
     monica  = local.ramble_hard.ip_address
     social  = local.ramble_hard.ip_address
   }
diff --git a/lotus-land-story/main.yml b/lotus-land-story/main.yml
index 68ebf87..77d8bd3 100644
--- a/lotus-land-story/main.yml
+++ b/lotus-land-story/main.yml
@@ -70,5 +70,6 @@
 - import_playbook: vector.yml      # noqa: name[play]
 - import_playbook: logs.yml        # noqa: name[play]
 - import_playbook: otel.yml        # noqa: name[play]
+- import_playbook: quire.yml       # noqa: name[play]
 
 # vim: ft=yaml.ansible
diff --git a/lotus-land-story/quire.yml b/lotus-land-story/quire.yml
new file mode 100644
index 0000000..06bf8d8
--- /dev/null
+++ b/lotus-land-story/quire.yml
@@ -0,0 +1,100 @@
+# https://github.com/kejadlen/quire
+- name: Set up Quire
+  hosts: lotus-land-story
+  vars:
+    version: 20260427-068b215
+  tasks:
+
+    - name: Create quire user
+      ansible.builtin.user:
+        name: quire
+        create_home: true
+      register: quire_user
+
+    - name: Create quire data directory
+      ansible.builtin.file:
+        path: /mnt/lotus-land-story/quire
+        state: directory
+        mode: "0755"
+        owner: "{{ quire_user.name }}"
+
+    - name: Create quire secrets directory
+      ansible.builtin.file:
+        path: /mnt/lotus-land-story/quire/secrets
+        state: directory
+        mode: "0700"
+        owner: "{{ quire_user.name }}"
+
+    - name: Write github_token secret
+      ansible.builtin.copy:
+        content: "{{ quire.github_pat }}"
+        dest: /mnt/lotus-land-story/quire/secrets/github_token
+        mode: "0600"
+        owner: "{{ quire_user.name }}"
+      no_log: true
+
+    - name: Write quire config
+      ansible.builtin.copy:
+        content: |
+          {:github {:token {:file "/var/quire/secrets/github_token"}}
+           :sentry {:dsn "{{ quire.sentry_dsn }}"}}
+        dest: /mnt/lotus-land-story/quire/config.fnl
+        mode: "0644"
+        owner: "{{ quire_user.name }}"
+      no_log: true
+
+    - name: Add quire user to docker group
+      ansible.builtin.user:
+        name: quire
+        groups: docker
+        append: true
+
+    - name: Add SSH keys for quire user
+      ansible.posix.authorized_key:
+        user: quire
+        key: https://github.com/kejadlen.keys
+
+    - name: Configure sshd for quire
+      ansible.builtin.copy:
+        dest: /etc/ssh/sshd_config.d/quire.conf
+        content: |
+          Match User quire
+              AuthorizedKeysFile {{ quire_user.home }}/.ssh/authorized_keys
+              ForceCommand docker exec --interactive quire quire exec "$SSH_ORIGINAL_COMMAND"
+              AllowTcpForwarding no
+              AllowAgentForwarding no
+              X11Forwarding no
+              PermitTTY no
+        mode: "0644"
+      notify: Restart ssh
+
+    - name: Run Quire
+      community.docker.docker_container:
+        name: quire
+        image: ghcr.io/kejadlen/quire:{{ version }}
+        env: {}
+        volumes:
+          - /mnt/lotus-land-story/quire:/var/quire
+        networks:
+          - name: lotus_land_story
+        restart_policy: unless-stopped
+        state: started
+        user: "{{ quire_user.uid }}"
+
+    - name: Run quire-gitweb
+      community.docker.docker_container:
+        name: quire-gitweb
+        image: ghcr.io/kejadlen/quire-gitweb:latest
+        volumes:
+          - /mnt/lotus-land-story/quire/repos:/var/quire/repos:ro
+        networks:
+          - name: lotus_land_story
+        restart_policy: unless-stopped
+        state: started
+        user: "{{ quire_user.uid }}"
+
+  handlers:
+    - name: Import restarts
+      ansible.builtin.import_tasks: restarts.yml
+
+# vim: ft=yaml.ansible
diff --git a/lotus-land-story/templates/Caddyfile b/lotus-land-story/templates/Caddyfile
index 9330e47..cf0abcd 100644
--- a/lotus-land-story/templates/Caddyfile
+++ b/lotus-land-story/templates/Caddyfile
@@ -84,6 +84,15 @@ https://metrics {
 
 ### Services
 
+quire {
+	tls internal
+	bind tailscale/quire
+	tailscale_auth
+	reverse_proxy quire:3000 {
+		header_up Remote-User {http.auth.user.tailscale_login}
+	}
+}
+
 irc {
 	tls internal
 	bind tailscale/irc
@@ -218,4 +227,8 @@ hey.kejadlen.dev
 	}
 }
 
+quire.kejadlen.dev {
+	reverse_proxy quire-gitweb:8080
+}
+
 # vim: ts=4