bump instance size, add certificate renewal stuff

infra/gcp/01-project.tf

@@ -9,7 +9,7 @@ resource "google_compute_address" "frappe-static" {
 
 resource "google_compute_instance" "frappe" {
   name         = "frappe"
-  machine_type = "e2-small"
+  machine_type = "e2-medium"
 
   tags = ["https-server", "http-server", "milestone-medical", "terraform"]
 
@@ -39,6 +39,8 @@ resource "google_compute_instance" "frappe" {
 
         systemctl enable --now /home/asbotehg/docker.service
         systemctl enable --now /home/asbotehg/docker-compose.app.service
+        systemctl enable --now /home/asbotehg/renew.service
+        systemctl enable --now /home/asbotehg/renew.timer
     EOT
   }
 
@@ -110,6 +112,29 @@ resource "google_compute_instance" "frappe" {
       }
   }
 
+  provisioner "file" {
+      source = "${path.module}/frappe/renew.timer"
+      destination = "renew.timer"
+      connection {
+          type  = "ssh"
+          host = self.network_interface[0].access_config[0].nat_ip
+          user = data.sops_file.gcp-secret.data["google.ssh.user"]
+          private_key = data.sops_file.gcp-secret.data["google.ssh.private_key"]
+          timeout = "4m"
+      }
+  }
+  provisioner "file" {
+      source = "${path.module}/frappe/renew.service"
+      destination = "renew.service"
+      connection {
+          type  = "ssh"
+          host = self.network_interface[0].access_config[0].nat_ip
+          user = data.sops_file.gcp-secret.data["google.ssh.user"]
+          private_key = data.sops_file.gcp-secret.data["google.ssh.private_key"]
+          timeout = "4m"
+      }
+  }
+
 }
 
 resource "google_compute_firewall" "default-ssh" {

infra/gcp/frappe/README.md

@@ -0,0 +1,33 @@
+# Restoring backups
+
+First, get the backup from s3, or r2, or wherever you put it.
+
+
+SCP the files onto the box.
+```bash
+scp 20241214_131900_20241214_131900* <url>:~/backups/
+```
+
+SSH onto to box.
+```bash
+ssh <url>.xyz
+```
+
+Get a shell on a container with "bench" running
+```bash
+cd ~/backups
+docker compose run -it -v $(pwd):/backup frontend sh
+
+whoami
+#this should return frappe, just doulbe check ur actually in the container...
+```
+
+Run the restore command
+```bash
+bench restore /backup/20241214_131900_20241214_131900-frontend-database.sql.gz --with-public-files /backup/20241214_131900_20241214_131900-frontend-files.tar --with-private-files
+ /backup/20241214_131900_20241214_131900-frontend-private-files.tar
+```
+
+> [!NOTE]
+> This last command may look like it hangs, give it some time.
+

infra/gcp/frappe/renew.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=Runs the renew script
+Requires=docker-compose.app.service
+After=docker-compose.app.service
+
+[Service]
+WorkingDirectory=/home/asbotehg
+ExecStart=/usr/bin/docker-compose run certbot renew
+Restart=on-failure  # Restart only on errors, not clean exits
+TimeoutStartSec=0
+
+[Install]
+WantedBy=multi-user.target

infra/gcp/frappe/renew.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description="Run renew.service every 24hours"
+
+[Timer]
+OnUnitActiveSec=24h
+OnCalendar=Mon..Sun *-*-* 10:00:*
+Unit=renew.service
+
+[Install]
+WantedBy=multi-user.target