tyro/infra

tyrolize 59d742f4ba Initial infra scaffold: watcher live on Infomaniak Public Cloud

- flake.nix exposes a devShell (openstackclient, opentofu, sops, age) plus
  nixosConfigurations.watcher (runtime) and packages.watcher-image (QCOW2
  via nixos-generators / openstack format).
- hosts/watcher/default.nix: SSH-only base, tyro user with key auth, root
  SSH disabled, trusted-users set so laptop closure pushes work.
- modules/website.nix: Caddy serves tyrolize.ch from sites/tyrolize.ch/;
  lize.ch 301-redirects; firewall opens 80/443. Let's Encrypt via HTTP-01.
- terraform/infomaniak/: OpenStack provider, security group (22/80/443),
  keypair, compute instance booted from the uploaded image. Auth via OS_*
  env vars sourced from terraform/infomaniak/.env by the devShell hook.
- scripts/build-image.sh + scripts/deploy.sh.
- dns/{tyrolize,lize}.ch.zone: full BIND zone files for the advanced view
  in Infomaniak DNS Manager; preserves kSuite mail records on lize.ch.

Watcher live at 195.15.203.200 (IPv6 2001:1600:10💯:b4e), NixOS 25.05.
HTTPS confirmed working on both domains.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-06-16 23:40:14 +02:00

2.8 KiB

Raw Blame History

remote_server

Personal infrastructure on Infomaniak Public Cloud (OpenStack), end-to-end Swiss. A small always-on watcher VM plus, later, on-demand workers using the same OpenStack APIs.

Layout

.
├── flake.nix                 # NixOS configs + watcher QCOW2 image package
├── hosts/
│   └── watcher/
│       └── default.nix       # services, users, SSH; boot/disk via openstack-* modules
├── terraform/
│   └── infomaniak/           # OpenStack provider, security group, instance
│       ├── main.tf
│       ├── variables.tf
│       ├── watcher.tf
│       ├── outputs.tf
│       ├── clouds.yaml.example
│       └── .env.example
├── scripts/
│   ├── build-image.sh        # build QCOW2 → upload to Infomaniak Glance
│   └── deploy.sh             # terraform apply → nixos-rebuild switch
└── .sops.yaml                # secrets encryption rules

First-time setup

Infomaniak Public Cloud project — Manager → Public Cloud → create a project. In the project's API access section, generate an application credential and copy the ID + secret.
Fill .env (gitignored, lives only in the repo — nothing in ~/.config):
```
cp terraform/infomaniak/.env.example terraform/infomaniak/.env
$EDITOR terraform/infomaniak/.env
```
Paste OS_APPLICATION_CREDENTIAL_ID, OS_APPLICATION_CREDENTIAL_SECRET, and TF_VAR_ssh_public_key.
Enter the dev shell — brings in openstack, terraform, jq, sops and auto-loads .env:
```
nix develop
```

Smoke-test auth and confirm catalogue defaults match:

openstack token issue
openstack flavor list | grep a2_ram4_disk20_perf1
openstack network list | grep ext-net1

Paste your SSH public key into hosts/watcher/default.nix (users.users.tyro.openssh.authorizedKeys.keys).
Build & upload the watcher image (~5 min the first time):
```
./scripts/build-image.sh
```
Provision and deploy:
```
./scripts/deploy.sh
```

After the script finishes: ssh tyro@<ipv4>.

Routine updates

From inside nix develop, edit the flake, then push:

nixos-rebuild switch --flake .#watcher --target-host tyro@<ipv4> --use-remote-sudo

You only need to re-run build-image.sh if you want fresh boots to start from a current image (e.g. after a major NixOS bump).

DNS

Managed at Infomaniak (registrar). After the watcher has IPs:

tyrolize.ch A/AAAA → watcher
*.tyrolize.ch A/AAAA → watcher (wildcard for subdomains served by Caddy)
lize.ch A/AAAA → watcher (for the 301 redirect to tyrolize.ch)
lize.ch MX/SPF/DKIM/DMARC → Infomaniak kSuite (auto-configured)
tyrolize.ch empty-SPF + DMARC p=reject (anti-spoofing on non-mail domain)

2.8 KiB Raw Blame History

remote_server

Layout

First-time setup

Routine updates

DNS

2.8 KiB

Raw Blame History