59d742f4ba
- flake.nix exposes a devShell (openstackclient, opentofu, sops, age) plus
nixosConfigurations.watcher (runtime) and packages.watcher-image (QCOW2
via nixos-generators / openstack format).
- hosts/watcher/default.nix: SSH-only base, tyro user with key auth, root
SSH disabled, trusted-users set so laptop closure pushes work.
- modules/website.nix: Caddy serves tyrolize.ch from sites/tyrolize.ch/;
lize.ch 301-redirects; firewall opens 80/443. Let's Encrypt via HTTP-01.
- terraform/infomaniak/: OpenStack provider, security group (22/80/443),
keypair, compute instance booted from the uploaded image. Auth via OS_*
env vars sourced from terraform/infomaniak/.env by the devShell hook.
- scripts/build-image.sh + scripts/deploy.sh.
- dns/{tyrolize,lize}.ch.zone: full BIND zone files for the advanced view
in Infomaniak DNS Manager; preserves kSuite mail records on lize.ch.
Watcher live at 195.15.203.200 (IPv6 2001:1600:10💯:b4e), NixOS 25.05.
HTTPS confirmed working on both domains.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
43 lines
1.8 KiB
Text
43 lines
1.8 KiB
Text
# Copy to `.env` (gitignored) and fill in real values from the clouds.yaml
|
|
# you can download at: Infomaniak Manager → Public Cloud → your project →
|
|
# API access → Download clouds.yaml.
|
|
#
|
|
# Once filled in, just run `nix develop` from the repo root — the devShell's
|
|
# shellHook automatically sources this file. Then `openstack ...` and
|
|
# `terraform ...` are authenticated.
|
|
|
|
# --- OpenStack auth (application credential = modern, recommended) ---
|
|
# In your downloaded clouds.yaml these live under:
|
|
# clouds.openstack.auth_type
|
|
# clouds.openstack.auth.auth_url
|
|
# clouds.openstack.auth.application_credential_id
|
|
# clouds.openstack.auth.application_credential_secret
|
|
export OS_AUTH_TYPE=v3applicationcredential
|
|
export OS_AUTH_URL=https://api.pub1.infomaniak.cloud/identity/v3
|
|
export OS_APPLICATION_CREDENTIAL_ID=REPLACE_ME
|
|
export OS_APPLICATION_CREDENTIAL_SECRET=REPLACE_ME
|
|
|
|
export OS_REGION_NAME=dc3-a
|
|
export OS_INTERFACE=public
|
|
export OS_IDENTITY_API_VERSION=3
|
|
|
|
# --- Alternative: legacy username + password auth ---
|
|
# Only if your clouds.yaml uses passwords instead of an application credential.
|
|
# Comment out the four OS_AUTH_TYPE / OS_AUTH_URL / OS_APPLICATION_* lines above
|
|
# and uncomment these instead:
|
|
#
|
|
# export OS_AUTH_URL=https://api.pub1.infomaniak.cloud/identity/v3
|
|
# export OS_PROJECT_ID=REPLACE_ME
|
|
# export OS_PROJECT_NAME=REPLACE_ME
|
|
# export OS_USER_DOMAIN_NAME=Default
|
|
# export OS_USERNAME=REPLACE_ME
|
|
# export OS_PASSWORD=REPLACE_ME
|
|
|
|
# --- Terraform variables ---
|
|
# Contents of ~/.ssh/id_ed25519.pub (one line, quoted).
|
|
export TF_VAR_ssh_public_key="ssh-ed25519 AAAA... tyro@lize.ch"
|
|
|
|
# Override defaults from variables.tf only if you want a different size/network:
|
|
# export TF_VAR_flavor_name="a2-ram4-disk50-perf1"
|
|
# export TF_VAR_external_network="ext-net1"
|
|
# export TF_VAR_watcher_image_name="nixos-watcher"
|