tyro/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Initial infra scaffold: watcher live on Infomaniak Public Cloud

Browse source 
- flake.nix exposes a devShell (openstackclient, opentofu, sops, age) plus
  nixosConfigurations.watcher (runtime) and packages.watcher-image (QCOW2
  via nixos-generators / openstack format).
- hosts/watcher/default.nix: SSH-only base, tyro user with key auth, root
  SSH disabled, trusted-users set so laptop closure pushes work.
- modules/website.nix: Caddy serves tyrolize.ch from sites/tyrolize.ch/;
  lize.ch 301-redirects; firewall opens 80/443. Let's Encrypt via HTTP-01.
- terraform/infomaniak/: OpenStack provider, security group (22/80/443),
  keypair, compute instance booted from the uploaded image. Auth via OS_*
  env vars sourced from terraform/infomaniak/.env by the devShell hook.
- scripts/build-image.sh + scripts/deploy.sh.
- dns/{tyrolize,lize}.ch.zone: full BIND zone files for the advanced view
  in Infomaniak DNS Manager; preserves kSuite mail records on lize.ch.

Watcher live at 195.15.203.200 (IPv6 2001:1600:10💯:b4e), NixOS 25.05.
HTTPS confirmed working on both domains.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
tyrolize 2026-06-16 23:40:14 +02:00
commit 59d742f4ba
18 changed files with 733 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

26
dns/lize.ch.zone Normal file
View file

@ -0,0 +1,26 @@
; Domain: lize.ch
; All existing kSuite mail records preserved exactly as-is.
; Adds: A/AAAA for the apex (Caddy on the watcher 301-redirects to
; https://tyrolize.ch), plus CAA restricting TLS to Let's Encrypt.
$TTL 3600
@ IN SOA ns11.infomaniak.ch. hostmaster.infomaniak.ch. (2026061610 10800 3600 605800 3600)
@ 3600 IN NS ns11.infomaniak.ch.
@ 3600 IN NS ns12.infomaniak.ch.
; --- kSuite mail (DO NOT TOUCH) ---
@ 3600 IN MX 5 mta-gw.infomaniak.ch.
@ 3600 IN TXT "v=spf1 include:spf.infomaniak.ch -all"
autoconfig 3600 IN CNAME infomaniak.com.
autodiscover 3600 IN CNAME infomaniak.com.
_dmarc 3600 IN TXT "v=DMARC1; p=reject;"
_domainkey 3600 IN NS ns11.infomaniak.ch.
_domainkey 3600 IN NS ns12.infomaniak.ch.
; --- New: apex points at watcher VM for the redirect to tyrolize.ch ---
@ 300 IN A 195.15.203.200
@ 300 IN AAAA 2001:1600:10:100::b4e
; --- Restrict TLS cert issuance to Let's Encrypt ---
@ 3600 IN CAA 0 issue "letsencrypt.org"

27
dns/tyrolize.ch.zone Normal file
View file

@ -0,0 +1,27 @@
; Domain: tyrolize.ch
; Adds A/AAAA + wildcard pointing at the watcher VM (195.15.203.200),
; plus anti-spoofing (no mail leaves this domain) and CAA restricting
; TLS issuance to Let's Encrypt.
$TTL 3600
@ IN SOA ns11.infomaniak.ch. hostmaster.infomaniak.ch. (2026061646 10800 3600 605800 3600)
@ 3600 IN NS ns11.infomaniak.ch.
@ 3600 IN NS ns12.infomaniak.ch.
; --- Watcher VM (short TTL during bring-up; raise to 3600 later if you want) ---
@ 300 IN A 195.15.203.200
@ 300 IN AAAA 2001:1600:10:100::b4e
* 300 IN A 195.15.203.200
* 300 IN AAAA 2001:1600:10:100::b4e
; --- Anti-spoofing: no mail is sent from tyrolize.ch ---
@ 3600 IN TXT "v=spf1 -all"
_dmarc 3600 IN TXT "v=DMARC1; p=reject; rua=mailto:tyro@lize.ch"
; --- Restrict TLS cert issuance to Let's Encrypt ---
@ 3600 IN CAA 0 issue "letsencrypt.org"
; --- Infomaniak default (harmless on non-mail domain) ---
_domainkey 3600 IN NS ns11.infomaniak.ch.
_domainkey 3600 IN NS ns12.infomaniak.ch.