No description
59d742f4ba
- flake.nix exposes a devShell (openstackclient, opentofu, sops, age) plus
nixosConfigurations.watcher (runtime) and packages.watcher-image (QCOW2
via nixos-generators / openstack format).
- hosts/watcher/default.nix: SSH-only base, tyro user with key auth, root
SSH disabled, trusted-users set so laptop closure pushes work.
- modules/website.nix: Caddy serves tyrolize.ch from sites/tyrolize.ch/;
lize.ch 301-redirects; firewall opens 80/443. Let's Encrypt via HTTP-01.
- terraform/infomaniak/: OpenStack provider, security group (22/80/443),
keypair, compute instance booted from the uploaded image. Auth via OS_*
env vars sourced from terraform/infomaniak/.env by the devShell hook.
- scripts/build-image.sh + scripts/deploy.sh.
- dns/{tyrolize,lize}.ch.zone: full BIND zone files for the advanced view
in Infomaniak DNS Manager; preserves kSuite mail records on lize.ch.
Watcher live at 195.15.203.200 (IPv6 2001:1600:10💯:b4e), NixOS 25.05.
HTTPS confirmed working on both domains.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|---|---|---|
| dns | ||
| hosts/watcher | ||
| modules | ||
| scripts | ||
| sites/tyrolize.ch | ||
| terraform/infomaniak | ||
| .gitignore | ||
| .sops.yaml | ||
| flake.lock | ||
| flake.nix | ||
| README.md | ||
remote_server
Personal infrastructure on Infomaniak Public Cloud (OpenStack), end-to-end Swiss. A small always-on watcher VM plus, later, on-demand workers using the same OpenStack APIs.
Layout
.
├── flake.nix # NixOS configs + watcher QCOW2 image package
├── hosts/
│ └── watcher/
│ └── default.nix # services, users, SSH; boot/disk via openstack-* modules
├── terraform/
│ └── infomaniak/ # OpenStack provider, security group, instance
│ ├── main.tf
│ ├── variables.tf
│ ├── watcher.tf
│ ├── outputs.tf
│ ├── clouds.yaml.example
│ └── .env.example
├── scripts/
│ ├── build-image.sh # build QCOW2 → upload to Infomaniak Glance
│ └── deploy.sh # terraform apply → nixos-rebuild switch
└── .sops.yaml # secrets encryption rules
First-time setup
- Infomaniak Public Cloud project — Manager → Public Cloud → create a project. In the project's API access section, generate an application credential and copy the ID + secret.
- Fill
.env(gitignored, lives only in the repo — nothing in~/.config):
Pastecp terraform/infomaniak/.env.example terraform/infomaniak/.env $EDITOR terraform/infomaniak/.envOS_APPLICATION_CREDENTIAL_ID,OS_APPLICATION_CREDENTIAL_SECRET, andTF_VAR_ssh_public_key. - Enter the dev shell — brings in
openstack,terraform,jq,sopsand auto-loads.env:nix develop - Smoke-test auth and confirm catalogue defaults match:
openstack token issue openstack flavor list | grep a2_ram4_disk20_perf1 openstack network list | grep ext-net1 - Paste your SSH public key into
hosts/watcher/default.nix(users.users.tyro.openssh.authorizedKeys.keys). - Build & upload the watcher image (~5 min the first time):
./scripts/build-image.sh - Provision and deploy:
./scripts/deploy.sh
After the script finishes: ssh tyro@<ipv4>.
Routine updates
From inside nix develop, edit the flake, then push:
nixos-rebuild switch --flake .#watcher --target-host tyro@<ipv4> --use-remote-sudo
You only need to re-run build-image.sh if you want fresh boots to start
from a current image (e.g. after a major NixOS bump).
DNS
Managed at Infomaniak (registrar). After the watcher has IPs:
tyrolize.chA/AAAA → watcher*.tyrolize.chA/AAAA → watcher (wildcard for subdomains served by Caddy)lize.chA/AAAA → watcher (for the 301 redirect to tyrolize.ch)lize.chMX/SPF/DKIM/DMARC → Infomaniak kSuite (auto-configured)tyrolize.chempty-SPF + DMARCp=reject(anti-spoofing on non-mail domain)