59d742f4ba
- flake.nix exposes a devShell (openstackclient, opentofu, sops, age) plus
nixosConfigurations.watcher (runtime) and packages.watcher-image (QCOW2
via nixos-generators / openstack format).
- hosts/watcher/default.nix: SSH-only base, tyro user with key auth, root
SSH disabled, trusted-users set so laptop closure pushes work.
- modules/website.nix: Caddy serves tyrolize.ch from sites/tyrolize.ch/;
lize.ch 301-redirects; firewall opens 80/443. Let's Encrypt via HTTP-01.
- terraform/infomaniak/: OpenStack provider, security group (22/80/443),
keypair, compute instance booted from the uploaded image. Auth via OS_*
env vars sourced from terraform/infomaniak/.env by the devShell hook.
- scripts/build-image.sh + scripts/deploy.sh.
- dns/{tyrolize,lize}.ch.zone: full BIND zone files for the advanced view
in Infomaniak DNS Manager; preserves kSuite mail records on lize.ch.
Watcher live at 195.15.203.200 (IPv6 2001:1600:10💯:b4e), NixOS 25.05.
HTTPS confirmed working on both domains.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
46 lines
1.6 KiB
Bash
Executable file
46 lines
1.6 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Build the watcher's NixOS QCOW2 image and upload it to Infomaniak Glance.
|
|
#
|
|
# Prereqs:
|
|
# - Run inside `nix develop` (provides openstackclient + nix + flakes).
|
|
# - terraform/infomaniak/.env populated and auto-sourced by the devShell.
|
|
# - SSH pubkey pasted into hosts/watcher/default.nix.
|
|
#
|
|
# Re-run any time the watcher's NixOS config changes if you want fresh boots
|
|
# from a current image. Routine config updates after boot use nixos-rebuild
|
|
# instead (no image rebuild required).
|
|
|
|
set -euo pipefail
|
|
|
|
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "$REPO_ROOT"
|
|
|
|
IMAGE_NAME="${TF_VAR_watcher_image_name:-nixos-watcher}"
|
|
|
|
: "${OS_AUTH_URL:?terraform/infomaniak/.env not loaded — run inside 'nix develop'}"
|
|
|
|
echo "==> building QCOW2 (this takes a few minutes the first time)"
|
|
nix build .#watcher-image
|
|
|
|
# nixos-generators names the file with the channel revision, e.g.
|
|
# nixos-image-openstack-25.05.20260102.ac62194-x86_64-linux.qcow2
|
|
QCOW=$(ls "$(readlink -f result)"/*.qcow2 | head -1)
|
|
[ -f "$QCOW" ] || { echo "no qcow2 found under result/" >&2; exit 1; }
|
|
ls -lh "$QCOW"
|
|
|
|
echo "==> uploading to Infomaniak Glance as '$IMAGE_NAME'"
|
|
# If an older copy exists, delete it first (Glance image names aren't unique).
|
|
if openstack image show "$IMAGE_NAME" -f value -c id >/dev/null 2>&1; then
|
|
echo " older image found — deleting"
|
|
openstack image delete "$IMAGE_NAME"
|
|
fi
|
|
|
|
openstack image create \
|
|
--disk-format qcow2 \
|
|
--container-format bare \
|
|
--file "$QCOW" \
|
|
--progress \
|
|
"$IMAGE_NAME"
|
|
|
|
echo "==> done. Image:"
|
|
openstack image show "$IMAGE_NAME" -f table -c id -c name -c status -c size
|