59d742f4ba
- flake.nix exposes a devShell (openstackclient, opentofu, sops, age) plus
nixosConfigurations.watcher (runtime) and packages.watcher-image (QCOW2
via nixos-generators / openstack format).
- hosts/watcher/default.nix: SSH-only base, tyro user with key auth, root
SSH disabled, trusted-users set so laptop closure pushes work.
- modules/website.nix: Caddy serves tyrolize.ch from sites/tyrolize.ch/;
lize.ch 301-redirects; firewall opens 80/443. Let's Encrypt via HTTP-01.
- terraform/infomaniak/: OpenStack provider, security group (22/80/443),
keypair, compute instance booted from the uploaded image. Auth via OS_*
env vars sourced from terraform/infomaniak/.env by the devShell hook.
- scripts/build-image.sh + scripts/deploy.sh.
- dns/{tyrolize,lize}.ch.zone: full BIND zone files for the advanced view
in Infomaniak DNS Manager; preserves kSuite mail records on lize.ch.
Watcher live at 195.15.203.200 (IPv6 2001:1600:10💯:b4e), NixOS 25.05.
HTTPS confirmed working on both domains.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
36 lines
1.1 KiB
HCL
36 lines
1.1 KiB
HCL
variable "ssh_public_key" {
|
|
description = "Contents of ~/.ssh/id_ed25519.pub (one line, starts with 'ssh-ed25519 ...')"
|
|
type = string
|
|
}
|
|
|
|
variable "ssh_key_name" {
|
|
description = "Display name for the keypair stored at Infomaniak"
|
|
type = string
|
|
default = "tyro-laptop"
|
|
}
|
|
|
|
# Flavor naming (confirmed from Infomaniak's catalogue, 2026-06):
|
|
# a{vCPU}_ram{GB}_disk{GB}[_perf1]
|
|
# _perf1 = higher-tier SSD; disk0 = bring-your-own-volume.
|
|
# 2 vCPU / 4 GB / 20 GB SSD = a2-ram4-disk20-perf1, ~CHF 7.5/mo.
|
|
|
|
variable "flavor_name" {
|
|
description = "OpenStack flavor for the watcher"
|
|
type = string
|
|
default = "a2-ram4-disk20-perf1"
|
|
}
|
|
|
|
# ext-net1 is the dual-stack public network — VMs get IPv4 + IPv6 directly.
|
|
# ext-floating1 is only needed when running instances behind a router.
|
|
|
|
variable "external_network" {
|
|
description = "Name of Infomaniak's public dual-stack network"
|
|
type = string
|
|
default = "ext-net1"
|
|
}
|
|
|
|
variable "watcher_image_name" {
|
|
description = "Name of the NixOS image previously uploaded to Glance"
|
|
type = string
|
|
default = "nixos-watcher"
|
|
}
|