59d742f4ba
- flake.nix exposes a devShell (openstackclient, opentofu, sops, age) plus
nixosConfigurations.watcher (runtime) and packages.watcher-image (QCOW2
via nixos-generators / openstack format).
- hosts/watcher/default.nix: SSH-only base, tyro user with key auth, root
SSH disabled, trusted-users set so laptop closure pushes work.
- modules/website.nix: Caddy serves tyrolize.ch from sites/tyrolize.ch/;
lize.ch 301-redirects; firewall opens 80/443. Let's Encrypt via HTTP-01.
- terraform/infomaniak/: OpenStack provider, security group (22/80/443),
keypair, compute instance booted from the uploaded image. Auth via OS_*
env vars sourced from terraform/infomaniak/.env by the devShell hook.
- scripts/build-image.sh + scripts/deploy.sh.
- dns/{tyrolize,lize}.ch.zone: full BIND zone files for the advanced view
in Infomaniak DNS Manager; preserves kSuite mail records on lize.ch.
Watcher live at 195.15.203.200 (IPv6 2001:1600:10💯:b4e), NixOS 25.05.
HTTPS confirmed working on both domains.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
84 lines
2.8 KiB
Markdown
84 lines
2.8 KiB
Markdown
# remote_server
|
|
|
|
Personal infrastructure on **Infomaniak Public Cloud** (OpenStack), end-to-end
|
|
Swiss. A small always-on **watcher** VM plus, later, on-demand workers using
|
|
the same OpenStack APIs.
|
|
|
|
## Layout
|
|
|
|
```
|
|
.
|
|
├── flake.nix # NixOS configs + watcher QCOW2 image package
|
|
├── hosts/
|
|
│ └── watcher/
|
|
│ └── default.nix # services, users, SSH; boot/disk via openstack-* modules
|
|
├── terraform/
|
|
│ └── infomaniak/ # OpenStack provider, security group, instance
|
|
│ ├── main.tf
|
|
│ ├── variables.tf
|
|
│ ├── watcher.tf
|
|
│ ├── outputs.tf
|
|
│ ├── clouds.yaml.example
|
|
│ └── .env.example
|
|
├── scripts/
|
|
│ ├── build-image.sh # build QCOW2 → upload to Infomaniak Glance
|
|
│ └── deploy.sh # terraform apply → nixos-rebuild switch
|
|
└── .sops.yaml # secrets encryption rules
|
|
```
|
|
|
|
## First-time setup
|
|
|
|
1. **Infomaniak Public Cloud project** — Manager → Public Cloud → create a
|
|
project. In the project's API access section, generate an
|
|
**application credential** and copy the ID + secret.
|
|
2. **Fill `.env`** (gitignored, lives only in the repo — nothing in `~/.config`):
|
|
```bash
|
|
cp terraform/infomaniak/.env.example terraform/infomaniak/.env
|
|
$EDITOR terraform/infomaniak/.env
|
|
```
|
|
Paste `OS_APPLICATION_CREDENTIAL_ID`, `OS_APPLICATION_CREDENTIAL_SECRET`,
|
|
and `TF_VAR_ssh_public_key`.
|
|
3. **Enter the dev shell** — brings in `openstack`, `terraform`, `jq`, `sops`
|
|
and auto-loads `.env`:
|
|
```bash
|
|
nix develop
|
|
```
|
|
4. **Smoke-test auth and confirm catalogue defaults match**:
|
|
```bash
|
|
openstack token issue
|
|
openstack flavor list | grep a2_ram4_disk20_perf1
|
|
openstack network list | grep ext-net1
|
|
```
|
|
5. **Paste your SSH public key** into `hosts/watcher/default.nix`
|
|
(`users.users.tyro.openssh.authorizedKeys.keys`).
|
|
6. **Build & upload the watcher image** (~5 min the first time):
|
|
```bash
|
|
./scripts/build-image.sh
|
|
```
|
|
7. **Provision and deploy**:
|
|
```bash
|
|
./scripts/deploy.sh
|
|
```
|
|
|
|
After the script finishes: `ssh tyro@<ipv4>`.
|
|
|
|
## Routine updates
|
|
|
|
From inside `nix develop`, edit the flake, then push:
|
|
|
|
```bash
|
|
nixos-rebuild switch --flake .#watcher --target-host tyro@<ipv4> --use-remote-sudo
|
|
```
|
|
|
|
You only need to re-run `build-image.sh` if you want **fresh boots** to start
|
|
from a current image (e.g. after a major NixOS bump).
|
|
|
|
## DNS
|
|
|
|
Managed at Infomaniak (registrar). After the watcher has IPs:
|
|
|
|
- `tyrolize.ch` A/AAAA → watcher
|
|
- `*.tyrolize.ch` A/AAAA → watcher (wildcard for subdomains served by Caddy)
|
|
- `lize.ch` A/AAAA → watcher (for the 301 redirect to tyrolize.ch)
|
|
- `lize.ch` MX/SPF/DKIM/DMARC → Infomaniak kSuite (auto-configured)
|
|
- `tyrolize.ch` empty-SPF + DMARC `p=reject` (anti-spoofing on non-mail domain)
|