forked from fediversity/fediversity
first time to get nix run pipeline to succeed including update step
Signed-off-by: Kiara Grouwstra <kiara@procolix.eu>
This commit is contained in:
parent
cb7f5076bb
commit
1df7548a43
SSH key fingerprint:
SHA256:COspvLoLJ5WC5rFb9ZDe5urVCkK4LJZOsjfF4duRJFU
5 changed files with 434 additions and 147 deletions
|
|
@ -96,6 +96,7 @@ let
|
||||||
with lib;
|
with lib;
|
||||||
attrValues (concatMapAttrs (_name: request: request.login-shell.packages) validRequests);
|
attrValues (concatMapAttrs (_name: request: request.login-shell.packages) validRequests);
|
||||||
extraGroups = lib.optional config.wheel "wheel";
|
extraGroups = lib.optional config.wheel "wheel";
|
||||||
|
password = "password";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
@ -112,7 +113,10 @@ let
|
||||||
};
|
};
|
||||||
implementation = cfg: {
|
implementation = cfg: {
|
||||||
resources = lib.optionalAttrs cfg.enable {
|
resources = lib.optionalAttrs cfg.enable {
|
||||||
hello.login-shell.packages.hello = pkgs.hello;
|
hello.login-shell = {
|
||||||
|
wheel = true;
|
||||||
|
packages.hello = pkgs.hello;
|
||||||
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
@ -128,12 +132,19 @@ let
|
||||||
# tests need this, however outside tests this (and esp its import nixos-test-base) must not be used
|
# tests need this, however outside tests this (and esp its import nixos-test-base) must not be used
|
||||||
../common/targetNode.nix
|
../common/targetNode.nix
|
||||||
"${nixpkgs}/nixos/modules/profiles/minimal.nix"
|
"${nixpkgs}/nixos/modules/profiles/minimal.nix"
|
||||||
"${nixpkgs}/nixos/modules/profiles/perlless.nix"
|
# "${nixpkgs}/nixos/modules/profiles/perlless.nix" # failed under disko
|
||||||
"${nixpkgs}/nixos/modules/profiles/qemu-guest.nix"
|
"${nixpkgs}/nixos/modules/profiles/qemu-guest.nix"
|
||||||
../../../infra/common/nixos/repart.nix
|
# systemd-repart
|
||||||
|
# ../../../infra/common/nixos/repart.nix
|
||||||
|
# disko
|
||||||
|
"${sources.disko}/module.nix"
|
||||||
|
../../../infra/common/proxmox-qemu-vm.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
|
# # non-disko
|
||||||
|
# boot.loader.grub.enable = false;
|
||||||
# boot.loader.systemd-boot.enable = true;
|
# boot.loader.systemd-boot.enable = true;
|
||||||
|
|
||||||
# boot.loader.efi.efiSysMountPoint = "/boot";
|
# boot.loader.efi.efiSysMountPoint = "/boot";
|
||||||
# boot.loader.systemd-boot.edk2-uefi-shell.enable = true;
|
# boot.loader.systemd-boot.edk2-uefi-shell.enable = true;
|
||||||
# boot.loader.efi.canTouchEfiVariables = true;
|
# boot.loader.efi.canTouchEfiVariables = true;
|
||||||
|
|
@ -142,8 +153,19 @@ let
|
||||||
# boot.growPartition = true;
|
# boot.growPartition = true;
|
||||||
# boot.loader.timeout = 1;
|
# boot.loader.timeout = 1;
|
||||||
|
|
||||||
|
nixpkgs.hostPlatform = "x86_64-linux";
|
||||||
|
|
||||||
system.stateVersion = "25.05";
|
system.stateVersion = "25.05";
|
||||||
services.qemuGuest.enable = true;
|
services.qemuGuest.enable = true;
|
||||||
|
systemd.services.qemu-guest-agent = {
|
||||||
|
wants = [ "network-online.target" ];
|
||||||
|
after = [ "network-online.target" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
services.openssh = {
|
||||||
|
enable = true;
|
||||||
|
settings.PasswordAuthentication = false;
|
||||||
|
};
|
||||||
networking = {
|
networking = {
|
||||||
firewall.enable = false;
|
firewall.enable = false;
|
||||||
usePredictableInterfaceNames = false;
|
usePredictableInterfaceNames = false;
|
||||||
|
|
@ -175,13 +197,46 @@ let
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
users.users = environment.config.resources."operator-environment".login-shell.apply {
|
security.sudo.wheelNeedsPassword = false;
|
||||||
resources = lib.filterAttrs (_name: value: value ? login-shell) (
|
nix.settings.trusted-users = [ "@wheel" ];
|
||||||
lib.concatMapAttrs (
|
|
||||||
k': req: lib.mapAttrs' (k: lib.nameValuePair "${k'}.${k}") req.resources
|
users.mutableUsers = false;
|
||||||
) requests
|
users.users =
|
||||||
);
|
{
|
||||||
};
|
root = {
|
||||||
|
# password = "password"; # cannot log in
|
||||||
|
hashedPassword = "$y$j9T$QoArNaV2VrjPhQ6BMG1AA.$uq8jw0.g.dJwIfepqipxzeUD1ochgUs8A5QmVe4qbJ6"; # cannot log in
|
||||||
|
# hashedPasswordFile = pkgs.writeText "root-password" "$y$j9T$QoArNaV2VrjPhQ6BMG1AA.$uq8jw0.g.dJwIfepqipxzeUD1ochgUs8A5QmVe4qbJ6"; # type not null/string
|
||||||
|
openssh.authorizedKeys.keys = [
|
||||||
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDHTIqF4CAylSxKPiSo5JOPuocn0y2z38wOSsQ1MUaZ2"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
# can log in
|
||||||
|
kiara = {
|
||||||
|
isNormalUser = true;
|
||||||
|
extraGroups = [ "wheel" ];
|
||||||
|
password = "password";
|
||||||
|
openssh.authorizedKeys.keys = [
|
||||||
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDHTIqF4CAylSxKPiSo5JOPuocn0y2z38wOSsQ1MUaZ2"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
# cannot log in
|
||||||
|
operator = {
|
||||||
|
isNormalUser = true;
|
||||||
|
extraGroups = [ "wheel" ];
|
||||||
|
password = "password";
|
||||||
|
openssh.authorizedKeys.keys = [
|
||||||
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDHTIqF4CAylSxKPiSo5JOPuocn0y2z38wOSsQ1MUaZ2"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
||||||
|
// environment.config.resources."operator-environment".login-shell.apply {
|
||||||
|
resources = lib.filterAttrs (_name: value: value ? login-shell) (
|
||||||
|
lib.concatMapAttrs (
|
||||||
|
k': req: lib.mapAttrs' (k: lib.nameValuePair "${k'}.${k}") req.resources
|
||||||
|
) requests
|
||||||
|
);
|
||||||
|
};
|
||||||
};
|
};
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
|
|
@ -291,7 +346,10 @@ let
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
single-nixos-vm-tf-proxmox = environment: {
|
single-nixos-vm-tf-proxmox = environment: {
|
||||||
resources."operator-environment".login-shell.username = "operator";
|
resources."operator-environment".login-shell = {
|
||||||
|
wheel = true;
|
||||||
|
username = "operator";
|
||||||
|
};
|
||||||
implementation =
|
implementation =
|
||||||
{
|
{
|
||||||
required-resources,
|
required-resources,
|
||||||
|
|
|
||||||
|
|
@ -44,7 +44,7 @@ in
|
||||||
networking.firewall.allowedTCPPorts = [ 22 ];
|
networking.firewall.allowedTCPPorts = [ 22 ];
|
||||||
|
|
||||||
# Test VMs don't have a bootloader by default.
|
# Test VMs don't have a bootloader by default.
|
||||||
boot.loader.grub.enable = false;
|
# boot.loader.grub.enable = false;
|
||||||
}
|
}
|
||||||
|
|
||||||
(mkIf config.enableAcme {
|
(mkIf config.enableAcme {
|
||||||
|
|
|
||||||
|
|
@ -397,140 +397,200 @@ let
|
||||||
tf-proxmox-host = mkOption {
|
tf-proxmox-host = mkOption {
|
||||||
description = "A Terraform deployment by SSH to update a single existing NixOS host.";
|
description = "A Terraform deployment by SSH to update a single existing NixOS host.";
|
||||||
# type = submodule (tf-host: {
|
# type = submodule (tf-host: {
|
||||||
type = submodule (tf-host: {
|
type = submodule (
|
||||||
options = {
|
tf-host:
|
||||||
system = mkOption {
|
let
|
||||||
description = "The architecture of the system to deploy to.";
|
raw = {
|
||||||
type = types.str;
|
# formatConfig = "${pkgs.nixos-generators}/share/nixos-generator/formats/raw.nix";
|
||||||
|
formatConfig = "${pkgs.nixos-generators}/share/nixos-generator/formats/raw-efi.nix";
|
||||||
|
formatAttr = "raw";
|
||||||
|
fileExtension = ".img";
|
||||||
};
|
};
|
||||||
inherit nixos-configuration;
|
format = raw;
|
||||||
ssh = host-ssh;
|
# qcow = {
|
||||||
# TODO: add proxmox info
|
# formatConfig = "${pkgs.nixos-generators}/share/nixos-generator/formats/qcow.nix";
|
||||||
module = mkOption {
|
# formatAttr = "qcow";
|
||||||
description = "The module to call to obtain the NixOS configuration from.";
|
# fileExtension = ".qcow2";
|
||||||
type = types.str;
|
# };
|
||||||
};
|
# format = qcow;
|
||||||
args = mkOption {
|
# qcow-efi = {
|
||||||
description = "The arguments with which to call the module to obtain the NixOS configuration.";
|
# formatConfig = "${pkgs.nixos-generators}/share/nixos-generator/formats/qcow-efi.nix";
|
||||||
type = types.attrs;
|
# formatAttr = "qcow-efi";
|
||||||
};
|
# fileExtension = ".qcow2";
|
||||||
deployment-name = mkOption {
|
# };
|
||||||
description = "The name of the deployment for which to obtain the NixOS configuration.";
|
# format = qcow-efi;
|
||||||
type = types.str;
|
inherit (format) formatConfig fileExtension formatAttr;
|
||||||
};
|
in
|
||||||
root-path = mkOption {
|
{
|
||||||
description = "The path to the root of the repository.";
|
options = {
|
||||||
type = types.path;
|
system = mkOption {
|
||||||
};
|
description = "The architecture of the system to deploy to.";
|
||||||
proxmox-user = mkOption {
|
type = types.str;
|
||||||
description = "The ProxmoX user to use.";
|
};
|
||||||
type = types.str;
|
inherit nixos-configuration;
|
||||||
default = "root@pam";
|
ssh = host-ssh;
|
||||||
};
|
# TODO: add proxmox info
|
||||||
# TODO: is sensitivity here handled properly?
|
module = mkOption {
|
||||||
proxmox-password = mkOption {
|
description = "The module to call to obtain the NixOS configuration from.";
|
||||||
description = "The ProxmoX password to use.";
|
type = types.str;
|
||||||
type = types.str;
|
};
|
||||||
};
|
args = mkOption {
|
||||||
node-name = mkOption {
|
description = "The arguments with which to call the module to obtain the NixOS configuration.";
|
||||||
description = "the name of the ProxmoX node to use.";
|
type = types.attrs;
|
||||||
type = types.str;
|
};
|
||||||
};
|
deployment-name = mkOption {
|
||||||
run = mkOption {
|
description = "The name of the deployment for which to obtain the NixOS configuration.";
|
||||||
type = types.package;
|
type = types.str;
|
||||||
# error: The option `tf-deployment.tf-host.run' is read-only, but it's set multiple times.
|
};
|
||||||
# readOnly = true;
|
root-path = mkOption {
|
||||||
default =
|
description = "The path to the root of the repository.";
|
||||||
let
|
type = types.path;
|
||||||
inherit (tf-host.config)
|
};
|
||||||
system
|
proxmox-user = mkOption {
|
||||||
ssh
|
description = "The ProxmoX user to use.";
|
||||||
module
|
type = types.str;
|
||||||
args
|
default = "root@pam";
|
||||||
deployment-name
|
};
|
||||||
root-path
|
# TODO: is sensitivity here handled properly?
|
||||||
proxmox-user
|
proxmox-password = mkOption {
|
||||||
proxmox-password
|
description = "The ProxmoX password to use.";
|
||||||
node-name
|
type = types.str;
|
||||||
;
|
};
|
||||||
inherit (ssh)
|
node-name = mkOption {
|
||||||
host
|
description = "the name of the ProxmoX node to use.";
|
||||||
username
|
type = types.str;
|
||||||
key-file
|
};
|
||||||
sshOpts
|
run = mkOption {
|
||||||
;
|
type = types.package;
|
||||||
deployment-type = "tf-proxmox-host";
|
# error: The option `tf-deployment.tf-host.run' is read-only, but it's set multiple times.
|
||||||
nixos_conf = writeConfig {
|
# readOnly = true;
|
||||||
inherit
|
default =
|
||||||
|
let
|
||||||
|
inherit (tf-host.config)
|
||||||
system
|
system
|
||||||
|
ssh
|
||||||
module
|
module
|
||||||
args
|
args
|
||||||
deployment-name
|
deployment-name
|
||||||
root-path
|
root-path
|
||||||
deployment-type
|
proxmox-user
|
||||||
|
proxmox-password
|
||||||
|
node-name
|
||||||
;
|
;
|
||||||
};
|
inherit (ssh)
|
||||||
# machine = import nixos_conf;
|
|
||||||
machine = import ./nixos.nix {
|
|
||||||
inherit sources system;
|
|
||||||
configuration = tf-host.config.nixos-configuration;
|
|
||||||
};
|
|
||||||
inherit (machine.config.boot.uki) name;
|
|
||||||
|
|
||||||
environment = {
|
|
||||||
key_file = key-file;
|
|
||||||
ssh_opts = sshOpts;
|
|
||||||
inherit
|
|
||||||
host
|
host
|
||||||
nixos_conf
|
username
|
||||||
|
key-file
|
||||||
|
sshOpts
|
||||||
;
|
;
|
||||||
proxmox_user = proxmox-user;
|
deployment-type = "tf-proxmox-host";
|
||||||
proxmox_password = proxmox-password;
|
nixos_conf = writeConfig {
|
||||||
ssh_user = username;
|
inherit
|
||||||
node_name = node-name;
|
system
|
||||||
# image = "${machine.config.system.build.image}/${name}.raw";
|
module
|
||||||
};
|
args
|
||||||
tf-env = pkgs.callPackage ./run/tf-proxmox/tf-env.nix { };
|
deployment-name
|
||||||
proxmox-host = "192.168.51.81"; # root@fediversity-proxmox
|
root-path
|
||||||
vm-names = [ "test14" ];
|
deployment-type
|
||||||
vm_name = "test14";
|
;
|
||||||
in
|
};
|
||||||
lib.trace (lib.strings.toJSON environment) pkgs.writers.writeBashBin "deploy-tf-proxmox.sh"
|
# machine = import nixos_conf;
|
||||||
(withPackages [
|
machine = import ./nixos.nix {
|
||||||
pkgs.jq
|
inherit sources system;
|
||||||
pkgs.qemu
|
configuration = tf-host.config.nixos-configuration;
|
||||||
pkgs.nixos-generators
|
# configuration = { ... }: {
|
||||||
pkgs.httpie
|
# imports = [
|
||||||
(pkgs.callPackage ./run/tf-proxmox/tf.nix { inherit sources; })
|
# tf-host.config.nixos-configuration
|
||||||
])
|
# ../infra/common/nixos/repart.nix
|
||||||
''
|
# ];
|
||||||
set -xe
|
# };
|
||||||
|
};
|
||||||
|
# inherit (machine.config.boot.uki) name;
|
||||||
|
name = "monkey";
|
||||||
|
|
||||||
# bash ./infra/proxmox-remove.sh \
|
# # systemd-repart
|
||||||
# --api-url "https://${proxmox-host}:8006/api2/json" \
|
# better for cross-compilation, worse for pre-/post-processing, doesn't support MBR: https://github.com/nix-community/disko/issues/550#issuecomment-2503736973
|
||||||
# --username "${proxmox-user}" \
|
# raw = "${machine.config.system.build.image}/${name}.raw";
|
||||||
# --password "${proxmox-password}" \
|
|
||||||
# --node "${node-name}" \
|
|
||||||
# 7014
|
|
||||||
# # ^ hardcoded ID of test14
|
|
||||||
# # ${lib.concatStringsSep " " vm-names}
|
|
||||||
|
|
||||||
# TODO after install: $nix_host_keys
|
# disko
|
||||||
# cp $tmpdir/${vm_name}_host_key /mnt/etc/ssh/ssh_host_ed25519_key
|
# worse for cross-compilation, better for pre-/post-processing, needs manual `imageSize`, random failures: https://github.com/nix-community/disko/issues/550#issuecomment-2503736973
|
||||||
# chmod 600 /mnt/etc/ssh/ssh_host_ed25519_key
|
raw = "${machine.config.system.build.diskoImages}/main.raw";
|
||||||
# cp $tmpdir/${vm_name}_host_key.pub /mnt/etc/ssh/ssh_host_ed25519_key.pub
|
|
||||||
# chmod 644 /mnt/etc/ssh/ssh_host_ed25519_key.pub
|
|
||||||
|
|
||||||
# .qcow2 is around half the size of .raw, on top of supporting backups - be it apparently at the cost of performance
|
# # nixos-generators: note it can straight-up do qcow2 as well, if we settle for nixos-generators
|
||||||
qemu-img convert -f raw -O qcow2 -C "${machine.config.system.build.image}/${name}.raw" /tmp/${name}.qcow2
|
# # `mount: /run/nixos-etc-metadata.J3iARWBtna: failed to setup loop device for /nix/store/14ka2bmx6lcnyr8ah2yl787sqcgxz5ni-etc-metadata.erofs.`
|
||||||
|
# # [`Error: Failed to parse os-release`](https://github.com/NixOS/nixpkgs/blob/5b1861820a3bc4ef2f60b0afcffb71ea43f5d000/pkgs/by-name/sw/switch-to-configuration-ng/src/src/main.rs#L151)
|
||||||
|
# raw = let
|
||||||
|
# # TODO parameterize things to let this flow into the terraform
|
||||||
|
# # btw qcow can be made by nixos-generators (qcow, qcow-efi) or by `image.repart`
|
||||||
|
# # wait, so i generate an image for the nixos config from the data model? how would i then propagate that to deploy?
|
||||||
|
# gen = import "${pkgs.nixos-generators}/share/nixos-generator/nixos-generate.nix" {
|
||||||
|
# inherit system formatConfig;
|
||||||
|
# inherit (sources) nixpkgs;
|
||||||
|
# configuration = tf-host.config.nixos-configuration;
|
||||||
|
# };
|
||||||
|
# in
|
||||||
|
# "${gen.config.system.build.${formatAttr}}/nixos${fileExtension}";
|
||||||
|
|
||||||
env ${toString (lib.mapAttrsToList (k: v: "TF_VAR_${k}=\"${toBash v}\"") environment)} \
|
environment = {
|
||||||
TF_VAR_image=/tmp/${name}.qcow2 \
|
key_file = key-file;
|
||||||
tf_env=${tf-env} bash ./deployment/run/tf-proxmox/run.sh
|
ssh_opts = sshOpts;
|
||||||
'';
|
inherit
|
||||||
|
host
|
||||||
|
nixos_conf
|
||||||
|
;
|
||||||
|
proxmox_user = proxmox-user;
|
||||||
|
proxmox_password = proxmox-password;
|
||||||
|
ssh_user = username;
|
||||||
|
node_name = node-name;
|
||||||
|
};
|
||||||
|
tf-env = pkgs.callPackage ./run/tf-proxmox/tf-env.nix { };
|
||||||
|
proxmox-host = "192.168.51.81"; # root@fediversity-proxmox
|
||||||
|
vm-names = [ "test14" ];
|
||||||
|
vm_name = "test14";
|
||||||
|
in
|
||||||
|
lib.trace (lib.strings.toJSON environment) pkgs.writers.writeBashBin "deploy-tf-proxmox.sh"
|
||||||
|
(withPackages [
|
||||||
|
pkgs.jq
|
||||||
|
pkgs.qemu
|
||||||
|
pkgs.nixos-generators
|
||||||
|
pkgs.httpie
|
||||||
|
(pkgs.callPackage ./run/tf-proxmox/tf.nix { inherit sources; })
|
||||||
|
])
|
||||||
|
''
|
||||||
|
set -xe
|
||||||
|
|
||||||
|
# bash ./infra/proxmox-remove.sh \
|
||||||
|
# --api-url "https://${proxmox-host}:8006/api2/json" \
|
||||||
|
# --username "${proxmox-user}" \
|
||||||
|
# --password "${proxmox-password}" \
|
||||||
|
# --node "${node-name}" \
|
||||||
|
# 7014
|
||||||
|
# # ^ hardcoded ID of test14
|
||||||
|
# # ${lib.concatStringsSep " " vm-names}
|
||||||
|
|
||||||
|
# TODO after install: $nix_host_keys
|
||||||
|
# cp $tmpdir/${vm_name}_host_key /mnt/etc/ssh/ssh_host_ed25519_key
|
||||||
|
# chmod 600 /mnt/etc/ssh/ssh_host_ed25519_key
|
||||||
|
# cp $tmpdir/${vm_name}_host_key.pub /mnt/etc/ssh/ssh_host_ed25519_key.pub
|
||||||
|
# chmod 644 /mnt/etc/ssh/ssh_host_ed25519_key.pub
|
||||||
|
|
||||||
|
# nixos-generate gives the burden of building revisions, while systemd-repart handles partitioning ~~at the burden of version revisions~~
|
||||||
|
# .qcow2 is around half the size of .raw, on top of supporting backups - be it apparently at the cost of performance
|
||||||
|
qemu-img convert -f raw -O qcow2 -C "${raw}" /tmp/${name}.qcow2
|
||||||
|
|
||||||
|
ls -l ${raw}
|
||||||
|
ls -l /tmp/${name}.qcow2
|
||||||
|
|
||||||
|
env ${toString (lib.mapAttrsToList (k: v: "TF_VAR_${k}=\"${toBash v}\"") environment)} \
|
||||||
|
TF_VAR_image=/tmp/${name}.qcow2 \
|
||||||
|
tf_env=${tf-env} bash ./deployment/run/tf-proxmox/run.sh
|
||||||
|
'';
|
||||||
|
# # don't really wanna deal with having to do versioned updates for now
|
||||||
|
# qemu-img convert -f raw -O qcow2 -C "${machine.config.system.build.image}/${name}.raw" /tmp/${name}.qcow2
|
||||||
|
};
|
||||||
};
|
};
|
||||||
};
|
}
|
||||||
});
|
);
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
in
|
in
|
||||||
|
|
|
||||||
|
|
@ -16,6 +16,7 @@ provider "proxmox" {
|
||||||
endpoint = "https://${var.host}:8006/"
|
endpoint = "https://${var.host}:8006/"
|
||||||
insecure = true
|
insecure = true
|
||||||
|
|
||||||
|
# used only for files and creating custom disks
|
||||||
ssh {
|
ssh {
|
||||||
agent = true
|
agent = true
|
||||||
# uncomment and configure if using api_token instead of password
|
# uncomment and configure if using api_token instead of password
|
||||||
|
|
@ -49,10 +50,12 @@ provider "proxmox" {
|
||||||
# program = ["sh", "-c", "echo \"{\\\"hash\\\":\\\"$(nix-hash ..)\\\"}\""]
|
# program = ["sh", "-c", "echo \"{\\\"hash\\\":\\\"$(nix-hash ..)\\\"}\""]
|
||||||
# }
|
# }
|
||||||
|
|
||||||
|
# FIXME handle known-hosts in TF state
|
||||||
# FIXME move to host
|
# FIXME move to host
|
||||||
# FIXME switch to base image shared between jobs as upload seems a bottleneck? e.g. by:
|
# FIXME switch to base image shared between jobs as upload seems a bottleneck? e.g. by:
|
||||||
# - recursive TF
|
# - recursive TF
|
||||||
# - hash in name over overwrite
|
# - hash in name over overwrite
|
||||||
|
# won't notice file changes: https://github.com/bpg/terraform-provider-proxmox/issues/677
|
||||||
resource "proxmox_virtual_environment_file" "upload" {
|
resource "proxmox_virtual_environment_file" "upload" {
|
||||||
# # https://developer.hashicorp.com/terraform/plugin/sdkv2/resources/retries-and-customizable-timeouts
|
# # https://developer.hashicorp.com/terraform/plugin/sdkv2/resources/retries-and-customizable-timeouts
|
||||||
# timeouts {
|
# timeouts {
|
||||||
|
|
@ -96,9 +99,12 @@ resource "proxmox_virtual_environment_file" "upload" {
|
||||||
|
|
||||||
resource "proxmox_virtual_environment_vm" "nix_vm" {
|
resource "proxmox_virtual_environment_vm" "nix_vm" {
|
||||||
lifecycle {
|
lifecycle {
|
||||||
ignore_changes = ["disk.import_from"]
|
# wait, would this not disseminate any changes to this property,
|
||||||
|
# or just defer syncing when only this changed?
|
||||||
|
ignore_changes = [
|
||||||
|
disk["import_from"],
|
||||||
|
]
|
||||||
}
|
}
|
||||||
|
|
||||||
node_name = var.node_name
|
node_name = var.node_name
|
||||||
pool_id = var.pool_id
|
pool_id = var.pool_id
|
||||||
description = var.description
|
description = var.description
|
||||||
|
|
@ -107,7 +113,9 @@ resource "proxmox_virtual_environment_vm" "nix_vm" {
|
||||||
# https://wiki.nixos.org/wiki/Virt-manager#Guest_Agent
|
# https://wiki.nixos.org/wiki/Virt-manager#Guest_Agent
|
||||||
agent {
|
agent {
|
||||||
enabled = true
|
enabled = true
|
||||||
# timeout = "15m"
|
# timeout = "5m"
|
||||||
|
timeout = "40s"
|
||||||
|
trim = true
|
||||||
}
|
}
|
||||||
|
|
||||||
cpu {
|
cpu {
|
||||||
|
|
@ -133,10 +141,12 @@ resource "proxmox_virtual_environment_vm" "nix_vm" {
|
||||||
backup = false
|
backup = false
|
||||||
cache = "none"
|
cache = "none"
|
||||||
|
|
||||||
# import_from = "local:import/vzdump-qemu-nixos-fediversity-test.qcow2"
|
# FIXME make the provider allow this as a distinct block to allow making this depend on VM id?
|
||||||
# import_from = "local:import/vzdump-qemu-nixos-fediversity-test.raw"
|
# import_from = "local:import/${proxmox_virtual_environment_vm.nix_vm.vm_id}-${local.dump_name}" # bogus import name to test if it would accept self-referential values here # may not refer to itself
|
||||||
|
# import_from = "local:import/${local.dump_name}"
|
||||||
import_from = proxmox_virtual_environment_file.upload.id
|
import_from = proxmox_virtual_environment_file.upload.id
|
||||||
# import_from = proxmox_virtual_environment_download_file.latest_ubuntu_22_jammy_qcow2_img.id
|
# import_from = proxmox_virtual_environment_download_file.latest_ubuntu_22_jammy_qcow2_img.id
|
||||||
|
# import_from = "local:import/jammy-server-cloudimg-amd64.qcow2"
|
||||||
}
|
}
|
||||||
|
|
||||||
efi_disk {
|
efi_disk {
|
||||||
|
|
@ -149,7 +159,7 @@ resource "proxmox_virtual_environment_vm" "nix_vm" {
|
||||||
network_device {
|
network_device {
|
||||||
model = "virtio"
|
model = "virtio"
|
||||||
bridge = "ovsbr0"
|
bridge = "ovsbr0"
|
||||||
vlan_id = 1305
|
vlan_id = 1305
|
||||||
}
|
}
|
||||||
|
|
||||||
operating_system {
|
operating_system {
|
||||||
|
|
@ -158,18 +168,170 @@ resource "proxmox_virtual_environment_vm" "nix_vm" {
|
||||||
|
|
||||||
scsi_hardware = "virtio-scsi-single"
|
scsi_hardware = "virtio-scsi-single"
|
||||||
bios = "ovmf"
|
bios = "ovmf"
|
||||||
|
|
||||||
|
# # used only for cloud-init
|
||||||
|
# initialization {
|
||||||
|
# ip_config {
|
||||||
|
# ipv4 {
|
||||||
|
# gateway = "eth0"
|
||||||
|
# address = "95.215.187.${proxmox_virtual_environment_vm.nix_vm.vm_id}" # error: self-referential block
|
||||||
|
# }
|
||||||
|
# ipv6 {
|
||||||
|
# gateway = "eth0"
|
||||||
|
# address = "2a00:51c0:13:1305::${proxmox_virtual_environment_vm.nix_vm.vm_id}"
|
||||||
|
# }
|
||||||
|
# }
|
||||||
|
# }
|
||||||
}
|
}
|
||||||
|
|
||||||
|
# FIXME expose (and handle thru) [`exec`](https://pve.proxmox.com/pve-docs/api-viewer/#/nodes/{node}/qemu/{vmid}/agent/exec) endpoint in proxmox TF provider? wait, what command would i use it for?: https://github.com/bpg/terraform-provider-proxmox/issues/1576
|
||||||
module "nixos-rebuild" {
|
module "nixos-rebuild" {
|
||||||
depends_on = [
|
|
||||||
proxmox_virtual_environment_vm.nix_vm
|
|
||||||
]
|
|
||||||
|
|
||||||
source = "../tf-single-host"
|
source = "../tf-single-host"
|
||||||
|
|
||||||
nixos_conf = var.nixos_conf
|
nixos_conf = var.nixos_conf
|
||||||
username = var.ssh_user
|
# username = var.ssh_user # refers to the proxmox ssh user, not the VM one
|
||||||
host = proxmox_virtual_environment_vm.nix_vm.ipv4_addresses[0][0]
|
username = "root"
|
||||||
|
# host = proxmox_virtual_environment_vm.nix_vm.ipv4_addresses[1][0] # does not exist (in time)
|
||||||
|
host = "95.215.187.${proxmox_virtual_environment_vm.nix_vm.vm_id}"
|
||||||
|
# host = "2a00:51c0:13:1305::${proxmox_virtual_environment_vm.nix_vm.vm_id}"
|
||||||
|
# host = "95.215.187.101"
|
||||||
|
# host = "2a00:51c0:13:1305::101"
|
||||||
key_file = var.key_file
|
key_file = var.key_file
|
||||||
ssh_opts = var.ssh_opts
|
ssh_opts = var.ssh_opts
|
||||||
}
|
}
|
||||||
|
|
||||||
|
# vm output: {
|
||||||
|
# "acpi" = true
|
||||||
|
# "agent" = tolist([
|
||||||
|
# {
|
||||||
|
# "enabled" = true
|
||||||
|
# "timeout" = "15m"
|
||||||
|
# "trim" = false
|
||||||
|
# "type" = "virtio"
|
||||||
|
# },
|
||||||
|
# ])
|
||||||
|
# "amd_sev" = tolist([])
|
||||||
|
# "audio_device" = tolist([])
|
||||||
|
# "bios" = "ovmf"
|
||||||
|
# "boot_order" = tolist(null) /* of string */
|
||||||
|
# "cdrom" = tolist([])
|
||||||
|
# "clone" = tolist([])
|
||||||
|
# "cpu" = tolist([
|
||||||
|
# {
|
||||||
|
# "affinity" = ""
|
||||||
|
# "architecture" = ""
|
||||||
|
# "cores" = 1
|
||||||
|
# "flags" = tolist(null) /* of string */
|
||||||
|
# "hotplugged" = 0
|
||||||
|
# "limit" = 0
|
||||||
|
# "numa" = true
|
||||||
|
# "sockets" = 1
|
||||||
|
# "type" = "x86-64-v2-AES"
|
||||||
|
# "units" = 1024
|
||||||
|
# },
|
||||||
|
# ])
|
||||||
|
# "description" = ""
|
||||||
|
# "disk" = tolist([
|
||||||
|
# {
|
||||||
|
# "aio" = "io_uring"
|
||||||
|
# "backup" = false
|
||||||
|
# "cache" = "none"
|
||||||
|
# "datastore_id" = "local"
|
||||||
|
# "discard" = "on"
|
||||||
|
# "file_format" = "qcow2"
|
||||||
|
# "file_id" = ""
|
||||||
|
# "import_from" = "local:import/qemu-nixos-fediversity-test.qcow2"
|
||||||
|
# "interface" = "scsi0"
|
||||||
|
# "iothread" = true
|
||||||
|
# "path_in_datastore" = "101/vm-101-disk-1.qcow2"
|
||||||
|
# "replicate" = true
|
||||||
|
# "serial" = ""
|
||||||
|
# "size" = 32
|
||||||
|
# "speed" = tolist([])
|
||||||
|
# "ssd" = true
|
||||||
|
# },
|
||||||
|
# ])
|
||||||
|
# "efi_disk" = tolist([
|
||||||
|
# {
|
||||||
|
# "datastore_id" = "local"
|
||||||
|
# "file_format" = "qcow2"
|
||||||
|
# "pre_enrolled_keys" = false
|
||||||
|
# "type" = "4m"
|
||||||
|
# },
|
||||||
|
# ])
|
||||||
|
# "hook_script_file_id" = tostring(null)
|
||||||
|
# "hostpci" = tolist([])
|
||||||
|
# "id" = "101"
|
||||||
|
# "initialization" = tolist([])
|
||||||
|
# "ipv4_addresses" = tolist([])
|
||||||
|
# "ipv6_addresses" = tolist([])
|
||||||
|
# "keyboard_layout" = "en-us"
|
||||||
|
# "kvm_arguments" = ""
|
||||||
|
# "mac_addresses" = tolist([])
|
||||||
|
# "machine" = ""
|
||||||
|
# "memory" = tolist([
|
||||||
|
# {
|
||||||
|
# "dedicated" = 2048
|
||||||
|
# "floating" = 0
|
||||||
|
# "hugepages" = ""
|
||||||
|
# "keep_hugepages" = false
|
||||||
|
# "shared" = 0
|
||||||
|
# },
|
||||||
|
# ])
|
||||||
|
# "migrate" = false
|
||||||
|
# "name" = ""
|
||||||
|
# "network_device" = tolist([
|
||||||
|
# {
|
||||||
|
# "bridge" = "vnet1306"
|
||||||
|
# "disconnected" = false
|
||||||
|
# "enabled" = true
|
||||||
|
# "firewall" = false
|
||||||
|
# "mac_address" = "BC:24:11:DE:E5:A8"
|
||||||
|
# "model" = "virtio"
|
||||||
|
# "mtu" = 0
|
||||||
|
# "queues" = 0
|
||||||
|
# "rate_limit" = 0
|
||||||
|
# "trunks" = ""
|
||||||
|
# "vlan_id" = 0
|
||||||
|
# },
|
||||||
|
# ])
|
||||||
|
# "network_interface_names" = tolist([])
|
||||||
|
# "node_name" = "node051"
|
||||||
|
# "numa" = tolist([])
|
||||||
|
# "on_boot" = true
|
||||||
|
# "operating_system" = tolist([
|
||||||
|
# {
|
||||||
|
# "type" = "l26"
|
||||||
|
# },
|
||||||
|
# ])
|
||||||
|
# "pool_id" = "Fediversity"
|
||||||
|
# "protection" = false
|
||||||
|
# "reboot" = false
|
||||||
|
# "reboot_after_update" = true
|
||||||
|
# "rng" = tolist([])
|
||||||
|
# "scsi_hardware" = "virtio-scsi-single"
|
||||||
|
# "serial_device" = tolist([])
|
||||||
|
# "smbios" = tolist([])
|
||||||
|
# "started" = true
|
||||||
|
# "startup" = tolist([])
|
||||||
|
# "stop_on_destroy" = false
|
||||||
|
# "tablet_device" = true
|
||||||
|
# "tags" = tolist(null) /* of string */
|
||||||
|
# "template" = false
|
||||||
|
# "timeout_clone" = 1800
|
||||||
|
# "timeout_create" = 1800
|
||||||
|
# "timeout_migrate" = 1800
|
||||||
|
# "timeout_move_disk" = 1800
|
||||||
|
# "timeout_reboot" = 1800
|
||||||
|
# "timeout_shutdown_vm" = 1800
|
||||||
|
# "timeout_start_vm" = 1800
|
||||||
|
# "timeout_stop_vm" = 300
|
||||||
|
# "tpm_state" = tolist([])
|
||||||
|
# "usb" = tolist([])
|
||||||
|
# "vga" = tolist([])
|
||||||
|
# "virtiofs" = tolist([])
|
||||||
|
# "vm_id" = 101
|
||||||
|
# "watchdog" = tolist([])
|
||||||
|
# }
|
||||||
|
output "ips" {
|
||||||
|
value = proxmox_virtual_environment_vm.nix_vm
|
||||||
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
{ ... }:
|
{ lib, ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
_class = "nixos";
|
_class = "nixos";
|
||||||
|
|
@ -11,6 +11,12 @@
|
||||||
# ];
|
# ];
|
||||||
|
|
||||||
boot = {
|
boot = {
|
||||||
|
loader.grub = {
|
||||||
|
enable = true;
|
||||||
|
efiSupport = lib.mkDefault true;
|
||||||
|
efiInstallAsRemovable = lib.mkDefault true;
|
||||||
|
device = "nodev";
|
||||||
|
};
|
||||||
initrd = {
|
initrd = {
|
||||||
availableKernelModules = [
|
availableKernelModules = [
|
||||||
"ata_piix"
|
"ata_piix"
|
||||||
|
|
@ -23,8 +29,9 @@
|
||||||
};
|
};
|
||||||
|
|
||||||
disko.devices.disk.main = {
|
disko.devices.disk.main = {
|
||||||
device = "/dev/vda";
|
device = "/dev/sda";
|
||||||
type = "disk";
|
type = "disk";
|
||||||
|
imageSize = "20G"; # needed for image generation
|
||||||
|
|
||||||
content = {
|
content = {
|
||||||
type = "gpt";
|
type = "gpt";
|
||||||
|
|
|
||||||
Loading…
Add table
Reference in a new issue