Skip to content

Commit bde8b68

Browse files
zzantozzzzantozz
committed
initial working stuff
This works and does what the README says.
1 parent aeb1222 commit bde8b68

File tree

5 files changed

+308
-0
lines changed

5 files changed

+308
-0
lines changed

‎README.md

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Terraformed Terraria
2+
3+
This is a simple Terraform project to help manage my Terraria server in Rackspace Public Cloud.
4+
5+
Supplied with appropriate variable values, it creates a 2G instance using the latest ubuntu image.
6+
7+
It creates a public key using your local one at ~/.ssh/id_rsa.pub and installs it on the instance.
8+
9+
It updates no-ip.com with the ip of the new instance for convenience.
10+
11+
Example usage with defaults:
12+
13+
TF_VAR_rax_token=$TOKEN TF_VAR_no_ip_password=$NO_IP_PW terraform plan
14+
15+
# Additional required steps!
16+
17+
This only sets up the instance. Next the Terraria binaries have to be installed. That's a touchy process, so I haven't
18+
tried to automate it yet.
19+
20+
The steps to do this are saved in the README in my TerrariaFiles archive (not in GitHub).

‎cloud-init.sh

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#!/bin/bash -e
2+
3+
apt-get update
4+
apt-get -y install unattended-upgrades
5+
6+
echo "${iptables_save}" | base64 -d > /etc/iptables.save
7+
echo "${unattended_upgrades}" | base64 -d > /etc/apt/apt.conf.d/50unattended-upgrades
8+
9+
iptables-restore /etc/iptables.save
10+
11+
cd /root
12+
wget https://raw.githubusercontent.com/theonemule/no-ip/master/no-ip.sh
13+
echo "b7a781b1d455adba6856dfc489756afff56b7f90dbf6e1b22547c34d136103a4 no-ip.sh" | sha256sum -c || {
14+
echo "no-ip.sh script failed checksum" >&2
15+
exit 1
16+
}
17+
# This script seems to have a bug. It won't work without a config file.
18+
touch no-ip-config
19+
bash no-ip.sh -c=no-ip-config -u=${no_ip_user} -p=${no_ip_password} -h=${no_ip_hostname} -d=true

‎instance-configs/iptables-save.txt

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Generated by iptables-save v1.8.5 on Tue Feb 22 23:10:03 2022
2+
*filter
3+
:INPUT ACCEPT [0:0]
4+
:FORWARD ACCEPT [0:0]
5+
:OUTPUT ACCEPT [0:0]
6+
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
7+
-A INPUT -s 70.123.226.90/32 -p tcp -m comment --comment "My home IP so anyone there can connect to Terraria worlds" -j ACCEPT
8+
-A INPUT -p tcp -m tcp --dport 22 -m comment --comment "SSH always open in case my home IP changes" -j ACCEPT
9+
-A INPUT -p tcp -j DROP
10+
COMMIT
11+
# Completed on Tue Feb 22 23:10:03 2022

‎instance-configs/unattended-upgrades.txt

+144
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
// Automatically upgrade packages from these (origin:archive) pairs
2+
//
3+
// Note that in Ubuntu security updates may pull in new dependencies
4+
// from non-security sources (e.g. chromium). By allowing the release
5+
// pocket these get automatically pulled in.
6+
Unattended-Upgrade::Allowed-Origins {
7+
"cloudmonitoring main";
8+
"${distro_id}:${distro_codename}";
9+
"${distro_id}:${distro_codename}-security";
10+
// Extended Security Maintenance; doesn't necessarily exist for
11+
// every release and this system may not have it installed, but if
12+
// available, the policy for updates is such that unattended-upgrades
13+
// should also install from here by default.
14+
"${distro_id}ESMApps:${distro_codename}-apps-security";
15+
"${distro_id}ESM:${distro_codename}-infra-security";
16+
"${distro_id}:${distro_codename}-updates";
17+
// "${distro_id}:${distro_codename}-proposed";
18+
// "${distro_id}:${distro_codename}-backports";
19+
};
20+
21+
// Python regular expressions, matching packages to exclude from upgrading
22+
Unattended-Upgrade::Package-Blacklist {
23+
// The following matches all packages starting with linux-
24+
// "linux-";
25+
26+
// Use $ to explicitely define the end of a package name. Without
27+
// the $, "libc6" would match all of them.
28+
// "libc6$";
29+
// "libc6-dev$";
30+
// "libc6-i686$";
31+
32+
// Special characters need escaping
33+
// "libstdc\+\+6$";
34+
35+
// The following matches packages like xen-system-amd64, xen-utils-4.1,
36+
// xenstore-utils and libxenstore3.0
37+
// "(lib)?xen(store)?";
38+
39+
// For more information about Python regular expressions, see
40+
// https://docs.python.org/3/howto/regex.html
41+
};
42+
43+
// This option controls whether the development release of Ubuntu will be
44+
// upgraded automatically. Valid values are "true", "false", and "auto".
45+
Unattended-Upgrade::DevRelease "auto";
46+
47+
// This option allows you to control if on a unclean dpkg exit
48+
// unattended-upgrades will automatically run
49+
// dpkg --force-confold --configure -a
50+
// The default is true, to ensure updates keep getting installed
51+
//Unattended-Upgrade::AutoFixInterruptedDpkg "true";
52+
53+
// Split the upgrade into the smallest possible chunks so that
54+
// they can be interrupted with SIGTERM. This makes the upgrade
55+
// a bit slower but it has the benefit that shutdown while a upgrade
56+
// is running is possible (with a small delay)
57+
Unattended-Upgrade::MinimalSteps "true";
58+
59+
// Install all updates when the machine is shutting down
60+
// instead of doing it in the background while the machine is running.
61+
// This will (obviously) make shutdown slower.
62+
// Unattended-upgrades increases logind's InhibitDelayMaxSec to 30s.
63+
// This allows more time for unattended-upgrades to shut down gracefully
64+
// or even install a few packages in InstallOnShutdown mode, but is still a
65+
// big step back from the 30 minutes allowed for InstallOnShutdown previously.
66+
// Users enabling InstallOnShutdown mode are advised to increase
67+
// InhibitDelayMaxSec even further, possibly to 30 minutes.
68+
//Unattended-Upgrade::InstallOnShutdown "false";
69+
70+
// Send email to this address for problems or packages upgrades
71+
// If empty or unset then no email is sent, make sure that you
72+
// have a working mail setup on your system. A package that provides
73+
// 'mailx' must be installed. E.g. "user@example.com"
74+
//Unattended-Upgrade::Mail "";
75+
76+
// Set this value to one of:
77+
// "always", "only-on-error" or "on-change"
78+
// If this is not set, then any legacy MailOnlyOnError (boolean) value
79+
// is used to chose between "only-on-error" and "on-change"
80+
//Unattended-Upgrade::MailReport "on-change";
81+
82+
// Remove unused automatically installed kernel-related packages
83+
// (kernel images, kernel headers and kernel version locked tools).
84+
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
85+
86+
// Do automatic removal of newly unused dependencies after the upgrade
87+
Unattended-Upgrade::Remove-New-Unused-Dependencies "true";
88+
89+
// Do automatic removal of unused packages after the upgrade
90+
// (equivalent to apt-get autoremove)
91+
Unattended-Upgrade::Remove-Unused-Dependencies "true";
92+
93+
// Automatically reboot *WITHOUT CONFIRMATION* if
94+
// the file /var/run/reboot-required is found after the upgrade
95+
Unattended-Upgrade::Automatic-Reboot "true";
96+
97+
// Automatically reboot even if there are users currently logged in
98+
// when Unattended-Upgrade::Automatic-Reboot is set to true
99+
//Unattended-Upgrade::Automatic-Reboot-WithUsers "true";
100+
101+
// If automatic reboot is enabled and needed, reboot at the specific
102+
// time instead of immediately
103+
// Default: "now"
104+
Unattended-Upgrade::Automatic-Reboot-Time "09:00";
105+
106+
// Use apt bandwidth limit feature, this example limits the download
107+
// speed to 70kb/sec
108+
//Acquire::http::Dl-Limit "70";
109+
110+
// Enable logging to syslog. Default is False
111+
// Unattended-Upgrade::SyslogEnable "false";
112+
113+
// Specify syslog facility. Default is daemon
114+
// Unattended-Upgrade::SyslogFacility "daemon";
115+
116+
// Download and install upgrades only on AC power
117+
// (i.e. skip or gracefully stop updates on battery)
118+
// Unattended-Upgrade::OnlyOnACPower "true";
119+
120+
// Download and install upgrades only on non-metered connection
121+
// (i.e. skip or gracefully stop updates on a metered connection)
122+
// Unattended-Upgrade::Skip-Updates-On-Metered-Connections "true";
123+
124+
// Verbose logging
125+
// Unattended-Upgrade::Verbose "false";
126+
127+
// Print debugging information both in unattended-upgrades and
128+
// in unattended-upgrade-shutdown
129+
// Unattended-Upgrade::Debug "false";
130+
131+
// Allow package downgrade if Pin-Priority exceeds 1000
132+
// Unattended-Upgrade::Allow-downgrade "false";
133+
134+
// When APT fails to mark a package to be upgraded or installed try adjusting
135+
// candidates of related packages to help APT's resolver in finding a solution
136+
// where the package can be upgraded or installed.
137+
// This is a workaround until APT's resolver is fixed to always find a
138+
// solution if it exists. (See Debian bug #711128.)
139+
// The fallback is enabled by default, except on Debian's sid release because
140+
// uninstallable packages are frequent there.
141+
// Disabling the fallback speeds up unattended-upgrades when there are
142+
// uninstallable packages at the expense of rarely keeping back packages which
143+
// could be upgraded or installed.
144+
// Unattended-Upgrade::Allow-APT-Mark-Fallback "true";

‎main.tf

+114
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
variable "rax_user" {
2+
default = "zzantoss"
3+
}
4+
variable "rax_tenant" {
5+
default = "654720"
6+
}
7+
variable "no_ip_user" {
8+
default = "zzantozz"
9+
}
10+
variable "no_ip_hostname" {
11+
default = "stewart-terraria.hopto.org"
12+
}
13+
variable "region" {
14+
default = "DFW"
15+
}
16+
17+
# Secret variables, no default
18+
variable "rax_token" {
19+
sensitive = true
20+
}
21+
variable "no_ip_password" {
22+
sensitive = true
23+
}
24+
25+
# Define required providers
26+
terraform {
27+
required_version = ">= 0.14.0"
28+
required_providers {
29+
openstack = {
30+
source = "terraform-provider-openstack/openstack"
31+
version = "~> 1.35.0"
32+
}
33+
}
34+
}
35+
36+
# Configure the OpenStack Provider
37+
provider "openstack" {
38+
user_name = var.rax_user
39+
tenant_id = var.rax_tenant
40+
token = var.rax_token
41+
auth_url = "https://identity.api.rackspacecloud.com/v2.0/"
42+
region = var.region
43+
}
44+
45+
data "openstack_images_image_ids_v2" "latest-ubuntu-image" {
46+
name_regex = "(?i)ubuntu"
47+
sort = "updated_at"
48+
}
49+
50+
/*
51+
The networking resources are broken? It's trying to use a url with /v2.0/v2.0 at the end.
52+
I'll cover this with iptables rules.
53+
54+
resource "openstack_networking_secgroup_v2" "main_security_group" {
55+
name = "main"
56+
description = "Security group for Terraria servers"
57+
}
58+
59+
resource "openstack_networking_secgroup_rule_v2" "main_sg_allow_ssh" {
60+
security_group_id = openstack_networking_secgroup_v2.main_security_group.id
61+
direction = "ingress"
62+
ethertype = "IPv4"
63+
protocol = "tcp"
64+
port_range_min = 22
65+
port_range_max = 22
66+
remote_ip_prefix = "0.0.0.0/0"
67+
}
68+
69+
resource "openstack_networking_secgroup_rule_v2" "main_sg_allow_home" {
70+
security_group_id = openstack_networking_secgroup_v2.main_security_group.id
71+
direction = "ingress"
72+
ethertype = "IPv4"
73+
protocol = "tcp"
74+
port_range_min = 1
75+
port_range_max = 65535
76+
remote_ip_prefix = "70.123.226.90/32"
77+
}
78+
*/
79+
80+
resource "openstack_compute_keypair_v2" "the-keypair" {
81+
name = "terraria-keypair"
82+
public_key = file("~/.ssh/id_rsa.pub")
83+
}
84+
85+
resource "openstack_compute_instance_v2" "terraform-test" {
86+
name = "terraformed-terraria-server"
87+
region = var.region
88+
image_id = data.openstack_images_image_ids_v2.latest-ubuntu-image.ids[0]
89+
flavor_id = "general1-2"
90+
key_pair = "terraria-keypair"
91+
// security_groups = ["main"]
92+
user_data = templatefile("cloud-init.sh", {
93+
iptables_save = base64encode(file("instance-configs/iptables-save.txt"))
94+
unattended_upgrades = base64encode(file("instance-configs/unattended-upgrades.txt"))
95+
no_ip_user = var.no_ip_user
96+
no_ip_password = var.no_ip_password
97+
no_ip_hostname = var.no_ip_hostname
98+
})
99+
depends_on = [openstack_compute_keypair_v2.the-keypair]
100+
101+
network {
102+
uuid = "00000000-0000-0000-0000-000000000000"
103+
name = "public"
104+
}
105+
106+
network {
107+
uuid = "11111111-1111-1111-1111-111111111111"
108+
name = "private"
109+
}
110+
}
111+
112+
output "instance_ip" {
113+
value = openstack_compute_instance_v2.terraform-test.access_ip_v4
114+
}

0 commit comments

Comments
 (0)