feat: tile worker (#1)

.github/workflows/terragrunt.yaml

@@ -0,0 +1,109 @@
+name: 'Terragrunt'
+on:
+  pull_request:
+    branches: [ "main" ]
+    paths:
+      - "deployment/**"
+      - ".github/workflows/terragrunt.yaml"
+  push:
+    branches: [ "main" ]
+    paths:
+      - "deployment/**"
+      - ".github/workflows/terragrunt.yaml"
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+env:
+  tofu_version: '1.7.1'
+  tg_version: '0.58.12'
+  working_dir: 'deployment'
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Checkout'
+        uses: actions/checkout@main
+
+      - name: Check Formatting
+        uses: gruntwork-io/terragrunt-action@v2
+        with:
+          tofu_version: ${{ env.tofu_version }}
+          tg_version: ${{ env.tg_version }}
+          tg_dir: ${{ env.working_dir }}
+          tg_command: 'hclfmt --terragrunt-check --terragrunt-diff'
+
+      - name: Check terraform fmt
+        uses: gruntwork-io/terragrunt-action@v2
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          TF_STATE_POSTGRES_CONN_STR: ${{ secrets.TF_STATE_POSTGRES_CONN_STR }}
+        with:
+          tofu_version: ${{ env.tofu_version }}
+          tg_version: ${{ env.tg_version }}
+          tg_dir: ${{ env.working_dir }}
+          tg_command: 'run-all fmt -diff -check'
+  plan:
+    runs-on: ubuntu-latest
+    if: github.ref != 'refs/heads/main'
+    steps:
+      - name: 'Checkout'
+        uses: actions/checkout@main
+
+      - name: Install Terragrunt
+        uses: eLco/setup-terragrunt@v1
+        with:
+          terragrunt_version: ${{ env.tg_version }}
+
+      - name: 'Install OpenTofu'
+        uses: opentofu/setup-opentofu@v1
+        with:
+          tofu_version: ${{ env.tofu_version }}
+          tofu_wrapper: false
+
+      - name: Plan All
+        working-directory: ${{ env.working_dir }}
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          TF_STATE_POSTGRES_CONN_STR: ${{ secrets.TF_STATE_POSTGRES_CONN_STR }}
+        run: terragrunt run-all plan -no-color 2>&1 | tee "${{github.workspace}}/plan_output.txt";
+
+#      - name: 'List files'
+#        run: 'ls -la ${{ github.workspace }}'
+
+#      - name: Comment Terraform Plan on PR
+#        uses: blinqas/tf-plan-pr-comment@v1
+#        with:
+#          output_file: "${{ github.workspace }}/plan_output.txt"
+#        env:
+#          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  deploy:
+    runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/main'
+    steps:
+      - name: 'Checkout'
+        uses: actions/checkout@main
+
+      - name: Install Terragrunt
+        uses: eLco/setup-terragrunt@v1
+        with:
+          terragrunt_version: ${{ env.tg_version }}
+
+      - name: 'Install OpenTofu'
+        uses: opentofu/setup-opentofu@v1
+        with:
+          tofu_version: ${{ env.tofu_version }}
+          tofu_wrapper: false
+
+      - name: Deploy All
+        working-directory: ${{ env.working_dir }}
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          TF_STATE_POSTGRES_CONN_STR: ${{ secrets.TF_STATE_POSTGRES_CONN_STR }}
+        run: terragrunt run-all apply --terragrunt-non-interactive

deployment/.gitignore

@@ -0,0 +1,38 @@
+# OpenTofu
+
+# Local .terraform directories
+**/.terraform/*
+
+# .tfstate files
+*.tfstate
+*.tfstate.*
+
+# Crash log files
+crash.log
+crash.*.log
+
+# Ignore override files as they are usually used to override resources locally and so
+# are not checked in
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+
+# Include override files you do wish to add to version control using negated pattern
+# !example_override.tf
+
+# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
+# example: *tfplan*
+
+# Ignore CLI configuration files
+.terraformrc
+terraform.rc
+
+# Terragrunt
+
+# terragrunt cache directories
+**/.terragrunt-cache/*
+
+# Terragrunt debug output file (when using `--terragrunt-debug` option)
+# See: https://terragrunt.gruntwork.io/docs/reference/cli-options/#terragrunt-debug
+terragrunt-debug.tfvars.json

deployment/modules/cloudflare/cloudflare.hcl

@@ -0,0 +1,9 @@
+locals {
+  cloudflare_account_id = get_env("CLOUDFLARE_ACCOUNT_ID")
+  cloudflare_api_token  = get_env("CLOUDFLARE_API_TOKEN")
+}
+
+inputs = {
+  cloudflare_account_id = local.cloudflare_account_id
+  cloudflare_api_token  = local.cloudflare_api_token
+}

deployment/modules/cloudflare/tiles/.terraform.lock.hcl

@@ -0,0 +1,25 @@
+# This file is maintained automatically by "tofu init".
+# Manual edits may be lost in future updates.
+
+provider "registry.opentofu.org/cloudflare/cloudflare" {
+  version     = "4.38.0"
+  constraints = "4.38.0"
+  hashes = [
+    "h1:HTomuzocukpNLwtWzeSF3yteCVsyVKbwKmN66u9iPac=",
+    "zh:171ab67cccceead4514fafb2d39e4e708a90cce79000aaf3c29aab7ed4457071",
+    "zh:18aa7228447baaaefc49a43e8eff970817a7491a63d8937e796357a3829dd979",
+    "zh:2cbaab6092e81ba6f41fa60a50f14e980c8ec327ee11d0b21f16a478be4b7567",
+    "zh:53b8e49c06f5b31a8c681f8c0669cf43e78abe71657b8182a221d096bb514965",
+    "zh:6037cfc60b4b647aabae155fcb46d649ed7c650e0287f05db52b2068f1e27c8a",
+    "zh:62460982ce1a869eebfca675603fbbd50416cf6b69459fb855bfbe5ae2b97607",
+    "zh:65f6f3a8470917b6398baa5eb4f74b3932b213eac7c0202798bfad6fd1ee17df",
+    "zh:890df766e9b839623b1f0437355032a3c006226a6c200cd911e15ee1a9014e9f",
+    "zh:8b5cebe64bf04105a49178a165b6a8800a9a33bae6767143a47fe4977755f805",
+    "zh:a5596635db0993ee3c3060fbc2227d91b239466e96d2d82642625a5aa2486988",
+    "zh:b3a9c63038441f13c311fd4b2c7e69e571445e5a7365a20c7cc9046b7e6c8aba",
+    "zh:b585e7e4d7648a540b14b9182819214896ca9337729eeb1f2034833b17db754d",
+    "zh:d2c3c545318ac8542369e9fc8228e29ee585febdf203a450fad3e0eded71ce02",
+    "zh:e95dd2d6c3525073af47d47b763cb81b6a51b20cabf76f789c69328922da9ecf",
+    "zh:eee6e590b36d6c6168a7daae8afa74a8721fd7aa9f62a710f04a311975100722",
+  ]
+}

deployment/modules/cloudflare/tiles/config.tf

@@ -0,0 +1,13 @@
+terraform {
+  backend "pg" {
+    schema_name = "prod_cloudflare_tiles"
+  }
+  required_version = "~> 1.7"
+
+  required_providers {
+    cloudflare = {
+      source  = "cloudflare/cloudflare"
+      version = "4.38.0"
+    }
+  }
+}

deployment/modules/cloudflare/tiles/providers.tf

@@ -0,0 +1,3 @@
+provider "cloudflare" {
+  api_token = data.terraform_remote_state.api_keys_state.outputs.terraform_key_cloudflare_account
+}

deployment/modules/cloudflare/tiles/r2.tf

@@ -0,0 +1,9 @@
+resource "cloudflare_r2_bucket" "tiles" {
+  account_id = var.cloudflare_account_id
+  name       = "tiles"
+}
+
+import {
+  to = cloudflare_r2_bucket.tiles
+  id = "${var.cloudflare_account_id}/tiles"
+}

deployment/modules/cloudflare/tiles/remote-state.tf

@@ -0,0 +1,8 @@
+data "terraform_remote_state" "api_keys_state" {
+  backend = "pg"
+
+  config = {
+    conn_str    = var.tf_state_postgres_conn_str
+    schema_name = "prod_cloudflare_api_keys"
+  }
+}

deployment/modules/cloudflare/tiles/terragrunt.hcl

@@ -0,0 +1,15 @@
+terraform {
+  source = "."
+
+  extra_arguments custom_vars {
+    commands = get_terraform_commands_that_need_vars()
+  }
+}
+
+include "cloudflare" {
+  path = find_in_parent_folders("cloudflare.hcl")
+}
+
+include "root" {
+  path = find_in_parent_folders("root.hcl")
+}

deployment/modules/cloudflare/tiles/variables.tf

@@ -0,0 +1,2 @@
+variable "cloudflare_account_id" {}
+variable "tf_state_postgres_conn_str" {}

deployment/modules/cloudflare/tiles/workers.tf

@@ -0,0 +1,36 @@
+data "cloudflare_zone" "immich_cloud" {
+  name = "immich.cloud"
+}
+
+resource "cloudflare_worker_script" "tiles" {
+  account_id = var.cloudflare_account_id
+  name       = "tiles"
+  content    = file("${path.module}/dist/tiles.js")
+
+  plain_text_binding {
+    name = "CACHE_CONTROL"
+    text = "2678400" // 31 days - cloudflare cdn maximum
+  }
+
+  plain_text_binding {
+    name = "ALLOWED_ORIGINS"
+    text = "*"
+  }
+
+  r2_bucket_binding {
+    name        = "BUCKET"
+    bucket_name = cloudflare_r2_bucket.tiles.name
+  }
+}
+
+resource "cloudflare_worker_domain" "tiles" {
+  account_id = var.cloudflare_account_id
+  hostname   = "tiles.immich.cloud"
+  service    = cloudflare_worker_script.tiles.id
+  zone_id    = data.cloudflare_zone.immich_cloud.zone_id
+}
+
+import {
+  to = cloudflare_worker_script.tiles
+  id = "${var.cloudflare_account_id}/tiles"
+}

deployment/root.hcl

@@ -0,0 +1,15 @@
+locals {
+  tf_state_postgres_conn_str = get_env("TF_STATE_POSTGRES_CONN_STR")
+}
+
+remote_state {
+  backend = "pg"
+
+  config = {
+    conn_str = local.tf_state_postgres_conn_str
+  }
+}
+
+inputs = {
+  tf_state_postgres_conn_str = local.tf_state_postgres_conn_str
+}