feat(ansible): configure coolify

.gitignore

@@ -8,6 +8,7 @@
 
 # Ansible
 ansible/inventory.ini
+.vault_pass
 
 # Private Keys & Secrets
 *.pem

ansible/ansible.cfg

@@ -0,0 +1,4 @@
+[defaults]
+inventory = inventory.ini
+vault_password_file = .vault_pass
+host_key_checking = False

ansible/group_vars/all/main.yml

@@ -0,0 +1,5 @@
+---
+ansible_user: "debian"
+
+sysadmin_user: "alessandrovitali"
+sysadmin_public_ssh_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAm/J+9YG+odym9In9C4iLcrfXlrlPK2TygtI7lBNNpl"

ansible/group_vars/all/vault.yml

@@ -0,0 +1,9 @@
+$ANSIBLE_VAULT;1.1;AES256
+65353035363835666333386634353332383639633462326134656533366434373363333636613938
+3163306136623962346363373030643330343364333139360a376334666363396337613631303663
+34376561376439353863646561616134636230366435653431643633313130356665313163663136
+3837396262376433350a646430383332633931383561383939336561616235336232623665316537
+37353537303138646630393733626262653362636661613336336565636162343835386265343262
+66323466616364306363313638633630343766313065646135336138396639343536326162393562
+34303234653937393637643031643066383537363632383663303062303230613135363336326135
+63366363353663366137

ansible/host_vars/coolify.yml

@@ -0,0 +1,3 @@
+coolify_root_username: "alessandrovitali"
+coolify_root_user_email: "[email protected]"
+coolify_root_user_password: "{{ vault_coolify_admin_password }}"

ansible/inventory.tpl

@@ -0,0 +1,2 @@
+[coolify]
+coolify ansible_host=${public_ip}

ansible/playbook.yml

@@ -0,0 +1,9 @@
+## ansible/setup.yml
+
+- name: Setup coolify machine
+  hosts: all
+  roles:
+    - role: studio.ansible.base
+    - role: studio.ansible.users
+    - role: studio.ansible.security
+    - role: studio.ansible.coolify

ansible/requirements.yml

@@ -0,0 +1,7 @@
+## ansible/requirements.yml
+
+collections:
+  - name: studio.ansible
+    source: https://git.studiovita.li/studio/ansible.git ## HTTPS
+    type: git
+    version: feat/coolify

terraform/main.tf

@@ -1,40 +1,61 @@
-# Fetch billing subsidiary details from your OVH account profile
+# Gather facts
-data "ovh_me" "myaccount" {}
+data "ovh_cloud_instance_flavors" "flavors" {
+  service_name = var.ovh_service_name
+  region       = var.ovh_region
+}
 
-# Provision the Classic VPS
+data "ovh_cloud_instance_images" "images" {
-resource "ovh_vps" "vps_1" {
+  service_name = var.ovh_service_name
-  display_name   = "coolify"
+  region       = var.ovh_region
+}
 
-  ovh_subsidiary = data.ovh_me.myaccount.ovh_subsidiary # Country of billing entity (e.g. "CH", "DE")
+resource "ovh_cloud_ssh_key" "ansible" {
-  plan = [
+  service_name = var.ovh_service_name
-    {
+  name         = "ansible-key"
-      duration     = "P1M"              # Monthly subscription ("P1M")
+  public_key   = var.ssh_public_key
-      plan_code    = "vps-le-2-2-40"    # Starter plan model (Adjust depending on current catalog)
+}
-      pricing_mode = "default"
 
-      # Datacenter configuration
+# Provision a d2-2 Public Cloud instance
-      configuration = [
+resource "ovh_cloud_instance" "coolify" {
-        {
+  service_name   = var.ovh_service_name
-          label = "vps_datacenter"
+  region         = var.ovh_region
-          value = "LIM" # Limburg (DE)
+  name           = var.project_name
-        },
+  ssh_key_name   = ovh_cloud_ssh_key.ansible.name
-        {
+
-          label = "vps_os"
+  flavor_id = one([
-          value = "ubuntu-22.04"
+    for flavor in data.ovh_cloud_instance_flavors.flavors.flavors :
-        }
+    flavor.id if flavor.name == var.ovh_flavor_name
+  ])
+
+  image_id = one([
+    for image in data.ovh_cloud_instance_images.images.images :
+    image.id if image.name == var.image_name
+  ])
+
+  networks = [
+    { auto_assign_public_ip = true },
   ]
-    }
+}
+
+# Fetch provisioned VM's public IPv4
+locals {
+  public_ip = one(flatten([
+    for net in ovh_cloud_instance.coolify.current_state.networks : [
+      for addr in net.addresses : addr.ip
+      if addr.type == "FIXED" && addr.version == 4
     ]
-
+  ]))
-  public_ssh_key = var.ssh_public_key
 }
 
-# The public IP of a classic VPS must be retrieved via a data source after delivery
+# Write IP to Ansible inventory
-data "ovh_vps" "vps_1" {
+resource "local_file" "ansible_inventory" {
-  service_name = ovh_vps.vps_1.service_name
+  content = templatefile("${path.module}/../ansible/inventory.tpl", {
+    public_ip = local.public_ip
+  })
+  filename = "${path.module}/../ansible/inventory.ini"
 }
 
-output "vps_public_ip" {
+output "public_ip" {
-  value       = tolist(data.ovh_vps.vps_1.ips)[0]
+  description = "The public IPv4 address of the provisioned OVHcloud VM"
-  description = "The public IP address of VPS-1"
+  value       = local.public_ip
 }

terraform/providers.tf

@@ -3,7 +3,11 @@ terraform {
   required_providers {
     ovh = {
       source  = "ovh/ovh"
-      version = ">= 2.0.0"
+      version = "~> 2.19.0"
+    }
+    local = {
+      source  = "hashicorp/local"
+      version = "~> 2.9.0"
     }
   }
 }

terraform/variables.tf

@@ -1,6 +1,11 @@
+variable "project_name" {
+  type        = string
+  description = "VM name"
+}
+
 variable "ovh_endpoint" {
   type        = string
-  description = "The OVH API endpoint"
+  description = "OVH API endpoint"
   default     = "ovh-eu"
 }
 
@@ -19,12 +24,30 @@ variable "ovh_consumer_key" {
   sensitive   = true
 }
 
-variable "ovh_project_id" {
+variable "ovh_service_name" {
   type        = string
-  description = "The OVH Public Cloud Project ID (Service Name)"
+  description = "OVHcloud Public Cloud Project ID"
+}
+
+variable "ovh_region" {
+  type        = string
+  description = "OVHcloud region code"
+  default     = "DE1" # Frankfurt, Germany
+}
+
+variable "ovh_flavor_name" {
+  type        = string
+  description = "VM flavor name"
+  default     = "d2-2"
+}
+
+variable "image_name" {
+  type        = string
+  description = "OS distribution image name to boot the VM from"
+  default     = "Debian 13"
 }
 
 variable "ssh_public_key" {
   type        = string
-  description = "The public SSH key to install on the VM"
+  description = "Public SSH key to install on the VM"
 }