initial

deploy/deploy.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+set -e
+
+cd "$(dirname "$0")/.."
+
+terraform apply -input=false -auto-approve tfplan
+ansible-playbook -i inventory deploy/site.yml
+echo "Deployed."

deploy/site.yml

@@ -0,0 +1,34 @@
+---
+- name: Deploy TinyCommerce
+  hosts: app
+  become: true
+  vars_files:
+    - vars/vault.yml
+
+  tasks:
+    - name: Install nginx
+      ansible.builtin.apt:
+        name: nginx
+        state: present
+
+    - name: Write app config
+      ansible.builtin.template:
+        src: app.env.j2
+        dest: /etc/tinycommerce/app.env
+        mode: "0600"
+
+    - name: Write nginx config
+      ansible.builtin.template:
+        src: nginx_web1.conf.j2
+        dest: /etc/nginx/sites-enabled/nginx_web1.conf
+        mode: "0644"
+
+    - name: Restart nginx
+      ansible.builtin.service:
+        name: nginx
+        state: restarted
+
+    - name: Restart app service
+      ansible.builtin.service:
+        name: tinycommerce
+        state: restarted

deploy/templates/app.env.j2

@@ -0,0 +1 @@
+DB_PASSWORD={{ db_password }}

deploy/templates/nginx_web1.conf.j2

@@ -0,0 +1,80 @@
+server {
+    listen                  443 ssl;
+    listen                  [::]:443 ssl;
+    http2                   on;
+    server_name             www.tinycommerce.com;
+    set                     $maintenance_site_key "tinycommerce.com";
+    set                     $base /var/www/html/tinycommerce.com;
+    root                    /var/www/html/tinycommerce.com/public;
+
+    ssl_certificate         /etc/letsencrypt/live/tinycommerce.com/fullchain.pem;
+    ssl_certificate_key     /etc/letsencrypt/live/tinycommerce.com/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/tinycommerce.com/chain.pem;
+    
+    include                 snippets/cloudflare-realip.conf;
+    include                 snippets/security.conf;
+    include                 snippets/maintenance-mode.conf;
+
+    access_log              /var/log/nginx/access.log;
+    error_log               /var/log/nginx/error.log;
+
+    index                   index.php;
+
+    location / {
+        if (-f /etc/nginx/maintenance/enabled) {
+            return 503;
+        }
+        try_files $uri $uri/ /index.php?$query_string;
+    }
+
+    include                 snippets/general.conf;
+    include                 snippets/wordpress.conf;
+    client_max_body_size    0;
+
+
+    location ~ \.php$ {
+        if (-f /etc/nginx/maintenance/enabled) {
+            return 503;
+        }
+        fastcgi_pass        unix:/var/run/php/php-wordpress.sock;
+        include             snippets/php-wordpress-fastcgi.conf;
+    }
+}
+
+server {
+    listen                  443 ssl;
+    listen                  [::]:443 ssl;
+    http2                   on;
+    server_name             tinycommerce.com;
+    set                     $maintenance_site_key "tinycommerce.com";
+
+    ssl_certificate         /etc/letsencrypt/live/tinycommerce.com/fullchain.pem;
+    ssl_certificate_key     /etc/letsencrypt/live/tinycommerce.com/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/tinycommerce.com/chain.pem;
+    include                 snippets/cloudflare-realip.conf;
+    include                 snippets/maintenance-mode.conf;
+
+    location / {
+        if (-f /etc/nginx/maintenance/enabled) {
+            return 503;
+        }
+        return 301 https://www.tinycommerce.com$request_uri;
+    }
+}
+
+server {
+    listen                  80;
+    listen                  [::]:80;
+    server_name             tinycommerce.com www.tinycommerce.com;
+    set                     $maintenance_site_key "tinycommerce.com";
+    include                 snippets/letsencrypt.conf;
+    include                 snippets/cloudflare-realip.conf;
+    include                 snippets/maintenance-mode.conf;
+
+    location / {
+        if (-f /etc/nginx/maintenance/enabled) {
+            return 503;
+        }
+        return 301 https://www.tinycommerce.com$request_uri;
+    }
+}

deploy/vars/vault.yml

@@ -0,0 +1,2 @@
+---
+db_password: "{{ lookup('ansible.builtin.env', 'DB_PASSWORD') }}"