59d742f4ba
- flake.nix exposes a devShell (openstackclient, opentofu, sops, age) plus
nixosConfigurations.watcher (runtime) and packages.watcher-image (QCOW2
via nixos-generators / openstack format).
- hosts/watcher/default.nix: SSH-only base, tyro user with key auth, root
SSH disabled, trusted-users set so laptop closure pushes work.
- modules/website.nix: Caddy serves tyrolize.ch from sites/tyrolize.ch/;
lize.ch 301-redirects; firewall opens 80/443. Let's Encrypt via HTTP-01.
- terraform/infomaniak/: OpenStack provider, security group (22/80/443),
keypair, compute instance booted from the uploaded image. Auth via OS_*
env vars sourced from terraform/infomaniak/.env by the devShell hook.
- scripts/build-image.sh + scripts/deploy.sh.
- dns/{tyrolize,lize}.ch.zone: full BIND zone files for the advanced view
in Infomaniak DNS Manager; preserves kSuite mail records on lize.ch.
Watcher live at 195.15.203.200 (IPv6 2001:1600:10💯:b4e), NixOS 25.05.
HTTPS confirmed working on both domains.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
45 lines
1.2 KiB
Bash
Executable file
45 lines
1.2 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Provision (or update) the watcher instance via OpenTofu, then push the
|
|
# latest flake config with nixos-rebuild.
|
|
#
|
|
# Prereqs:
|
|
# - Watcher image already uploaded to Glance (run scripts/build-image.sh once)
|
|
# - Run inside `nix develop` (auto-sources terraform/infomaniak/.env)
|
|
#
|
|
# Idempotent: safe to re-run.
|
|
|
|
set -euo pipefail
|
|
|
|
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "$REPO_ROOT"
|
|
|
|
: "${OS_AUTH_URL:?terraform/infomaniak/.env not loaded — run inside 'nix develop'}"
|
|
: "${TF_VAR_ssh_public_key:?TF_VAR_ssh_public_key missing — paste pubkey into .env}"
|
|
|
|
echo "==> tofu apply"
|
|
pushd terraform/infomaniak >/dev/null
|
|
tofu init -upgrade
|
|
tofu apply -auto-approve
|
|
IPV4=$(tofu output -raw watcher_ipv4)
|
|
popd >/dev/null
|
|
|
|
echo "==> watcher at $IPV4"
|
|
|
|
echo "==> waiting for SSH"
|
|
for _ in $(seq 1 60); do
|
|
if ssh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=3 \
|
|
-o BatchMode=yes tyro@"$IPV4" true 2>/dev/null; then
|
|
break
|
|
fi
|
|
sleep 2
|
|
done
|
|
|
|
echo "==> nixos-rebuild switch"
|
|
nixos-rebuild switch \
|
|
--flake "$REPO_ROOT#watcher" \
|
|
--target-host "tyro@$IPV4" \
|
|
--use-remote-sudo
|
|
|
|
echo
|
|
echo "Done."
|
|
echo " ssh tyro@$IPV4"
|