feat: add placeholder env variables

.github/workflows/ansible.yml

@@ -82,4 +82,5 @@ jobs:
           CADDY_GITHUB_CLIENT_ID: ${{ secrets.CADDY_GITHUB_CLIENT_ID }}
           CADDY_GITHUB_CLIENT_SECRET: ${{ secrets.CADDY_GITHUB_CLIENT_SECRET }}
           CADDY_JWT_SHARED_KEY: ${{ secrets.CADDY_JWT_SHARED_KEY }}
+          # This is used by caddy to configure dns records
           CADDY_DIGITALOCEAN_API_TOKEN: ${{ secrets.CADDY_DIGITALOCEAN_API_TOKEN }}

ansible/roles/docker-swarm-app-caddy/assets/Caddyfile

@@ -52,6 +52,6 @@
 auth.{{domain}} {
 	authenticate with myportal
 	tls {
-		dns digitalocean {env.CADDY_DIGITALOCEAN_API_TOKEN}
+		dns digitalocean {env.DIGITALOCEAN_API_TOKEN}
 	}
 }

ansible/roles/docker-swarm-app-caddy/assets/caddy-stack.yml

@@ -24,10 +24,12 @@ services:
       - caddy_github_client_id
       - caddy_github_client_secret
       - caddy_jwt_shared_key
+      - caddy_digitalocean_api_token
     environment:
       GITHUB_CLIENT_ID_FILE: /run/secrets/caddy_github_client_id
       GITHUB_CLIENT_SECRET_FILE: /run/secrets/caddy_github_client_secret
       JWT_SHARED_KEY_FILE: /run/secrets/caddy_jwt_shared_key
+      DIGITALOCEAN_API_TOKEN: /run/secrets/caddy_jwt_shared_key
     deploy:
       placement:
         constraints:

terraform/digitalocean/caddy.tf

@@ -0,0 +1,69 @@
+/**
+ * # Caddy configuration
+ *
+ * We need to collect some configuration so we can configure Caddy
+ * This include auth, and DNS configurations
+ */
+
+
+ /**
+ * Github environnement secrets placeholder for caddy
+ *
+ */
+resource "github_actions_environment_secret" "caddy_github_client_id" {
+  repository       = data.github_repository.repo.name
+  environment      = github_repository_environment.digitalocean_environment.environment
+  secret_name      = "CADDY_GITHUB_CLIENT_ID"
+  lifecycle {
+    # This resource is intended as place holder chnaging the value after creation is ok
+    ignore_changes = [
+      plaintext_value,
+    ]
+  }
+}
+
+resource "github_actions_environment_secret" "caddy_github_client_secret" {
+  repository       = data.github_repository.repo.name
+  environment      = github_repository_environment.digitalocean_environment.environment
+  secret_name      = "CADDY_GITHUB_CLIENT_SECRET"
+  lifecycle {
+    # This resource is intended as place holder chnaging the value after creation is ok
+    ignore_changes = [
+      plaintext_value,
+    ]
+  }
+}
+
+# Generate a new SSH key
+resource "tls_private_key" "caddy_jwt_shared_key" {
+  algorithm = "RSA"
+  rsa_bits  = "4096"
+}
+
+resource "github_actions_environment_secret" "caddy_jwt_shared_key" {
+  repository       = data.github_repository.repo.name
+  environment      = github_repository_environment.digitalocean_environment.environment
+  secret_name      = "CADDY_JWT_SHARED_KEY"
+  plaintext_value  = tls_private_key.caddy_jwt_shared_key.private_key_openssh
+
+  lifecycle {
+    # This resource is intended as place holder chnaging the value after creation is ok
+    ignore_changes = [
+      plaintext_value,
+    ]
+  }
+}
+
+resource "github_actions_environment_secret" "caddy_digitalocean_api_token" {
+  repository       = data.github_repository.repo.name
+  environment      = github_repository_environment.digitalocean_environment.environment
+  secret_name      = "CADDY_DIGITALOCEAN_API_TOKEN"
+  plaintext_value  = ""
+
+  lifecycle {
+    # This resource is intended as place holder chnaging the value after creation is ok
+    ignore_changes = [
+      plaintext_value,
+    ]
+  }
+}

terraform/digitalocean/digitalocean.tf

@@ -0,0 +1,51 @@
+
+/**
+ * # DigitalOcean Project
+ *
+ * Projects let you organize your DigitalOcean resources 
+ * (like Droplets, Spaces, and load balancers) into groups.
+ */
+resource "digitalocean_project" "infra-bootstrap-tools" {
+  name        = "infra-bootstrap-tools"
+  description = "Startup infra for small self-hosted project"
+  purpose     = "IoT"
+  environment = "Development"
+  resources = concat(
+    digitalocean_droplet.nodes.*.urn,
+    digitalocean_droplet.managers.*.urn
+  )
+}
+
+# Generate a new SSH key
+resource "tls_private_key" "ssh" {
+  algorithm = "RSA"
+  rsa_bits  = "4096"
+}
+
+# Reguster the new SSH key to digitalocean
+resource "digitalocean_ssh_key" "infra" {
+  name       = "infra-bootstrap-tools-digitalocean"
+  public_key = tls_private_key.ssh.public_key_openssh
+}
+
+resource "digitalocean_droplet" "managers" {
+  count = var.manager_count
+
+  image  = "ubuntu-20-04-x64"
+  name   = "manager${count.index}"
+  region = "lon1"
+  size   = "s-1vcpu-1gb"
+
+  ssh_keys = [digitalocean_ssh_key.infra.id]
+}
+
+resource "digitalocean_droplet" "nodes" {
+  count = var.worker_count
+
+  image  = "ubuntu-20-04-x64"
+  name   = "node${count.index}"
+  region = "lon1"
+  size   = "s-1vcpu-1gb"
+
+  ssh_keys = [digitalocean_ssh_key.infra.id]
+}

terraform/digitalocean/github.tf

@@ -45,16 +45,9 @@ resource "github_branch_protection" "main" {
 }
 
 /**
- * Github environnement secrets
+ * Github environnement secrets for Ansible
  *
  */
-resource "github_actions_environment_secret" "test_secret" {
-  repository       = data.github_repository.repo.name
-  environment      = github_repository_environment.digitalocean_environment.environment
-  secret_name      = "test_secret_name"
-  plaintext_value  = "%s"
-}
-
 resource "github_actions_environment_secret" "inventory" {
   repository       = data.github_repository.repo.name
   environment      = github_repository_environment.digitalocean_environment.environment

terraform/digitalocean/main.tf

@@ -1,59 +0,0 @@
-
-/**
- * # DigitalOcean Project
- *
- * Projects let you organize your DigitalOcean resources 
- * (like Droplets, Spaces, and load balancers) into groups.
- */
-resource "digitalocean_project" "infra-bootstrap-tools" {
-  name        = "infra-bootstrap-tools"
-  description = "Startup infra for small self-hosted project"
-  purpose     = "IoT"
-  environment = "Development"
-  resources = concat(
-    digitalocean_droplet.nodes.*.urn,
-    digitalocean_droplet.managers.*.urn
-  )
-}
-
-# Generate a new SSH key
-resource "tls_private_key" "ssh" {
-  algorithm = "RSA"
-  rsa_bits  = "4096"
-}
-
-# Reguster the new SSH key to digitalocean
-resource "digitalocean_ssh_key" "infra" {
-  name       = "infra-bootstrap-tools-digitalocean"
-  public_key = tls_private_key.ssh.public_key_openssh
-}
-
-resource "digitalocean_droplet" "managers" {
-  count = var.manager_count
-
-  image  = "ubuntu-20-04-x64"
-  name   = "manager${count.index}"
-  region = "lon1"
-  size   = "s-1vcpu-1gb"
-
-  ssh_keys = [digitalocean_ssh_key.infra.id]
-}
-
-resource "digitalocean_droplet" "nodes" {
-  count = var.worker_count
-
-  image  = "ubuntu-20-04-x64"
-  name   = "node${count.index}"
-  region = "lon1"
-  size   = "s-1vcpu-1gb"
-
-  ssh_keys = [digitalocean_ssh_key.infra.id]
-}
-
-output "managers_ip" {
-  value = digitalocean_droplet.managers.*.ipv4_address
-}
-
-output "nodes_ip" {
-  value = digitalocean_droplet.nodes.*.ipv4_address
-}

terraform/digitalocean/outputs.tf

@@ -0,0 +1,7 @@
+output "managers_ip" {
+  value = digitalocean_droplet.managers.*.ipv4_address
+}
+
+output "nodes_ip" {
+  value = digitalocean_droplet.nodes.*.ipv4_address
+}

terraform/digitalocean/versions.tf

@@ -1,17 +1,20 @@
 terraform {
+  required_version = "~>1.19"
+
   required_providers {
+
     digitalocean = {
       source = "digitalocean/digitalocean"
-      version = "~> 2.25"
+      version = "~>2.25"
     }
     github = {
       source = "integrations/github"
-      version = "~> 5.0"
+      version = "~>5.0"
     }
 
     tls = {
       source = "hashicorp/tls"
-      version = "~> 3.3"
+      version = "~>3.3"
     }
 
     sshclient = {