Tomter Vel — infrastructure

Everything the vel's own site needs on one host, as containers: Caddy for TLS, NATS with JetStream for the records, Kanidm for who is who, and portal, the site itself. The content (pages, forms, desks) lives in tomtervel/questions and is fetched from there; this repo owns the host.

Internet ──► Caddy (Let's Encrypt)
               ├── PORTAL_HOST ──► portal:3000 ──► NATS (records) + Kanidm (login)
               └── ID_HOST ─────► kanidm:8443 (internal TLS)

Today the vel's draft site runs on Klingenberg Bygg's host as vel.klingenbergbygg.no, sharing that host's Kanidm and NATS. This repo is the same site on a host of the vel's own, with a Kanidm of its own, so nothing about the vel's members or records depends on anyone else.

First start

On a fresh Linux host with docker (compose plugin) and openssl:

git clone https://prosjekt.klingenbergbygg.no/tomtervel/infrastructure /srv/tomtervel/infrastructure
cd /srv/tomtervel/infrastructure
cp .env.example .env      # set PORTAL_HOST and ID_HOST; DNS must point here
sh bootstrap.sh           # renders configs, makes the internal cert, starts, recovers Kanidm admin
sh kanidm-setup.sh        # logs in, creates the portal client and desk groups, restarts portal

bootstrap.sh prints the admin and idm_admin passwords once; write them down. After kanidm-setup.sh, https://PORTAL_HOST serves the site and https://ID_HOST is the login.

People and desks

Each group in the content (qualifies: under questions/) is a Kanidm group tomtervel_<group>, all members of tomtervel_members. Someone in tomtervel_styret logs in and sees the board's desk.

kanidm -D idm_admin -H https://ID_HOST person create kari "Kari Lien"
kanidm -D idm_admin -H https://ID_HOST person update kari --mail kari@example.no
kanidm -D idm_admin -H https://ID_HOST person credential create-reset-token kari
kanidm -D idm_admin -H https://ID_HOST group add-members tomtervel_styret kari

Membership is read at login; someone added while logged in logs out and in again.

Content changes

A push to tomtervel/questions is linted on push and tells the portal to reload over NATS. That reload reaches the host it runs on: today Klingenberg Bygg's. For this host, start the runner profile once with a registration token from the tomtervel org's Actions settings:

docker compose --profile runner up -d

and give the content repo's lint-and-reload.yml a reload job with runs-on: tomtervel that runs nats --server nats://portal:$NATS_PASSWORD@127.0.0.1:4222 pub portal.content.reload "". Until then, docker compose restart portal picks up new content.

Upgrading portal

Bump PORTAL_RELEASE in .env (a tag of uhhm/portal) and docker compose up -d --build portal. Keep IRIS_RELEASE in the content repo's workflow matched to it.

Backups

• Kanidm writes a nightly backup into its volume (/data/backups, seven kept); copy that directory off the host.
• NATS JetStream data is the nats_data volume: every record ever submitted and every state change. Snapshot the volume.
• Caddy's certificates regenerate; nothing to keep.

What is not here

Mail (a person's reset link is a token you hand them), monitoring, and the vel's current website at tomtervel.no, which stays where it is until the vel points the apex at PORTAL_HOST.