chore: initial commit

.envrc

@@ -0,0 +1 @@
+use flake .

.github/renovate.json5

@@ -0,0 +1,35 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    ":dependencyDashboard",
+    ":disableRateLimiting",
+    "docker:enableMajor",
+    "docker:pinDigests",
+    ":automergeDigest",
+    ":automergePatch",
+    ":timezone(Europe/Warsaw)",
+    "github>deedee-ops/nixlab//.github/renovate/autoMerge.json5",
+    "github>deedee-ops/nixlab//.github/renovate/commitMessage.json5",
+    "github>deedee-ops/nixlab//.github/renovate/labels.json5",
+    "github>deedee-ops/nixlab//.github/renovate/semanticCommits.json5",
+  ],
+  "gitAuthor": "robodexo2000 <150604236+robodexo2000[bot]@users.noreply.github.com>",
+  "dependencyDashboardTitle": "Renovate Dashboard 🤖",
+  "suppressNotifications": [
+    "prEditedNotification",
+    "prIgnoreNotification",
+  ],
+  "commitBodyTable": true,
+  "rebaseWhen": "auto",
+  "nix": {
+    "enabled": true,
+  },
+  "lockFileMaintenance": {
+    "enabled": true,
+    "automerge": true,
+    "schedule": [
+      "before 4am on Sunday",
+    ],
+  },
+}

.github/renovate/autoMerge.json5

@@ -0,0 +1,14 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "packageRules": [
+    {
+      "description": "Auto merge GitHub Actions",
+      "matchManagers": ["github-actions"],
+      "matchDatasources": ["github-tags"],
+      "automerge": true,
+      "ignoreTests": true,
+      "automergeType": "branch",
+      "matchUpdateTypes": ["minor", "patch", "digest"]
+    }
+  ]
+}

.github/renovate/commitMessage.json5

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "commitMessageTopic": "{{depName}}",
+  "commitMessageExtra": "to {{newVersion}}",
+  "commitMessageSuffix": "",
+}

.github/renovate/labels.json5

@@ -0,0 +1,29 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "packageRules": [
+    {
+      "matchUpdateTypes": ["major"],
+      "labels": ["type/major"]
+    },
+    {
+      "matchUpdateTypes": ["minor"],
+      "labels": ["type/minor"]
+    },
+    {
+      "matchUpdateTypes": ["patch"],
+      "labels": ["type/patch"]
+    },
+    {
+      "matchUpdateTypes": ["digest"],
+      "labels": ["type/digest"]
+    },
+    {
+      "matchDatasources": ["terraform-provider"],
+      "addLabels": ["renovate/tofu"]
+    },
+    {
+      "matchManagers": ["github-actions"],
+      "addLabels": ["renovate/github-action"]
+    }
+  ]
+}

.github/renovate/semanticCommits.json5

@@ -0,0 +1,51 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "packageRules": [
+    {
+      "matchDatasources": ["terraform-provider"],
+      "matchUpdateTypes": ["major"],
+      "commitMessagePrefix": "feat(terraform)!: ",
+      "commitMessageTopic": "{{depName}}",
+      "commitMessageExtra": "( {{currentVersion}} → {{newVersion}} )"
+    },
+    {
+      "matchDatasources": ["terraform-provider"],
+      "matchUpdateTypes": ["minor"],
+      "semanticCommitType": "feat",
+      "semanticCommitScope": "terraform",
+      "commitMessageTopic": "{{depName}}",
+      "commitMessageExtra": "( {{currentVersion}} → {{newVersion}} )"
+    },
+    {
+      "matchDatasources": ["terraform-provider"],
+      "matchUpdateTypes": ["patch"],
+      "semanticCommitType": "fix",
+      "semanticCommitScope": "terraform",
+      "commitMessageTopic": "{{depName}}",
+      "commitMessageExtra": "( {{currentVersion}} → {{newVersion}} )"
+    },
+    {
+      "matchManagers": ["github-actions"],
+      "matchUpdateTypes": ["major"],
+      "commitMessagePrefix": "feat(github-action)!: ",
+      "commitMessageTopic": "{{depName}}",
+      "commitMessageExtra": "( {{currentVersion}} → {{newVersion}} )"
+    },
+    {
+      "matchManagers": ["github-actions"],
+      "matchUpdateTypes": ["minor"],
+      "semanticCommitType": "feat",
+      "semanticCommitScope": "github-action",
+      "commitMessageTopic": "{{depName}}",
+      "commitMessageExtra": "( {{currentVersion}} → {{newVersion}} )"
+    },
+    {
+      "matchManagers": ["github-actions"],
+      "matchUpdateTypes": ["patch"],
+      "semanticCommitType": "fix",
+      "semanticCommitScope": "github-action",
+      "commitMessageTopic": "{{depName}}",
+      "commitMessageExtra": "( {{currentVersion}} → {{newVersion}} )"
+    }
+  ]
+}

.github/workflows/renovate.yaml

@@ -0,0 +1,78 @@
+# yamllint disable rule:comments
+---
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
+name: "Renovate"
+
+'on':
+  workflow_dispatch:
+    inputs:
+      dryRun:
+        description: Dry Run
+        default: "false"
+        required: false
+      logLevel:
+        description: Log Level
+        default: debug
+        required: false
+      version:
+        description: Renovate version
+        default: latest
+        required: false
+  schedule:
+    - cron: "0 * * * *"  # Every hour
+  push:
+    branches:
+      - master
+    paths:
+      - .github/renovate.json5
+      - .github/renovate/**.json5
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
+  cancel-in-progress: true
+
+# Retrieve BOT_USER_ID via `curl -s "https://api.github.com/users/${BOT_USERNAME}%5Bbot%5D" | jq .id`
+env:
+  RENOVATE_PLATFORM: github
+  RENOVATE_PLATFORM_COMMIT: true
+  RENOVATE_ONBOARDING_CONFIG_FILE_NAME: .github/renovate.json5
+  RENOVATE_AUTODISCOVER: true
+  RENOVATE_AUTODISCOVER_FILTER: "${{ github.repository }}"
+  RENOVATE_USERNAME: "${{ secrets.BOT_USERNAME }}[bot]"
+  RENOVATE_GIT_AUTHOR: >-
+    ${{ secrets.BOT_USERNAME }}
+    <${{ secrets.BOT_USER_ID }}+${{ secrets.BOT_USERNAME }}[bot]@users.noreply.github.com>
+  WORKFLOW_RENOVATE_DRY_RUN: false
+  WORKFLOW_RENOVATE_LOG_LEVEL: debug
+  WORKFLOW_RENOVATE_VERSION: latest
+
+jobs:
+  renovate:
+    name: Renovate
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generate Token
+        uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1
+        id: app-token
+        with:
+          app-id: "${{ secrets.BOT_APP_ID }}"
+          private-key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"
+
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          token: "${{ steps.app-token.outputs.token }}"
+
+      - name: Override Default Config
+        shell: bash
+        run: |
+          echo "RENOVATE_DRY_RUN=${{ github.event.inputs.dryRun || env.WORKFLOW_RENOVATE_DRY_RUN }}" >> "${GITHUB_ENV}"
+          echo "LOG_LEVEL=${{ github.event.inputs.logLevel || env.WORKFLOW_RENOVATE_LOG_LEVEL }}" >> "${GITHUB_ENV}"
+
+      - name: Renovate
+        uses: renovatebot/github-action@936628dfbff213ab2eb95033c5e123cfcaf09ebb # v41.0.5
+        with:
+          configurationFile: "${{ env.RENOVATE_ONBOARDING_CONFIG_FILE_NAME }}"
+          token: "${{ steps.app-token.outputs.token }}"
+          renovate-version: "${{ github.event.inputs.version || env.WORKFLOW_RENOVATE_VERSION }}"
+# yamllint enable rule:comments

.gitignore

@@ -0,0 +1,20 @@
+result
+tmp
+.direnv
+.pre-commit-config.yaml
+
+### Terraform ###
+**/.terraform/*
+*.tfstate
+*.tfstate.*
+crash.log
+crash.*.log
+*.tfvars
+*.tfvars.json
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+.terraformrc
+terraform.rc
+!*.sops.tfvars

.sops.yaml

@@ -0,0 +1,10 @@
+---
+keys:
+  - users:
+      - &ajgon age13s2dafyr9sfltp8heujttxug4v4m3qhj7sxzqrj6x6x3cu5n29uqfvj62l
+
+creation_rules:
+  - path_regex: .*\.sops\.tfvars$
+    key_groups:
+      - age:
+          - *ajgon

.yamllint

@@ -0,0 +1,11 @@
+---
+extends: default
+
+rules:
+  line-length:
+    allow-non-breakable-words: true
+    allow-non-breakable-inline-mappings: true
+    max: 120
+
+ignore:
+  - "*.sops.y*ml"

README.md

@@ -0,0 +1 @@
+# external

cloudflare/firewall.tf

@@ -0,0 +1,55 @@
+resource "cloudflare_ruleset" "external_ingress" {
+  kind    = "zone"
+  name    = "default"
+  phase   = "http_request_firewall_custom"
+  zone_id = data.cloudflare_zone.base_domain.id
+
+  rules {
+    action = "skip"
+    action_parameters {
+      ruleset = "current"
+    }
+    description = "Allow access to kromgo API for shields.io"
+    enabled     = true
+    expression  = "(http.host eq \"kromgo.${var.base_domain}\" and ip.geoip.asnum in {30081 54825})"
+
+    logging {
+      enabled = true
+    }
+  }
+
+  rules {
+    action = "skip"
+    action_parameters {
+      ruleset = "current"
+    }
+    description = "Allow access to ArgoCD webhook for GitHub"
+    enabled     = true
+    expression  = "(http.host eq \"argocd.${var.base_domain}\") and (ip.geoip.asnum eq 36459) and (http.request.uri.path eq \"/api/webhook\")"
+
+    logging {
+      enabled = true
+    }
+  }
+
+  rules {
+    action = "skip"
+    action_parameters {
+      ruleset = "current"
+    }
+    description = "Allow access to external services"
+    enabled     = true
+    expression  = "(http.host eq \"share.${var.base_domain}\" and (not starts_with(http.request.uri.path, \"/admin\"))) and (ip.geoip.country in {\"PL\"} and (not cf.client.bot) and (cf.threat_score lt 15))"
+
+    logging {
+      enabled = true
+    }
+  }
+
+  rules {
+    action      = "block"
+    description = "Block everything else"
+    enabled     = true
+    expression  = "true"
+  }
+}

cloudflare/main.tf

@@ -0,0 +1,14 @@
+terraform {
+  required_providers {
+    cloudflare = {
+      source  = "cloudflare/cloudflare"
+      version = "4.47.0"
+    }
+  }
+
+  required_version = ">= 1.6.0"
+}
+
+data "cloudflare_zone" "base_domain" {
+  name = var.base_domain
+}