forked from fediversity/fediversity
		
	Compare commits
	
		
			7 commits
		
	
	
		
			2ed4c63979
			...
			be83e34f9b
		
	
	| Author | SHA1 | Date | |
|---|---|---|---|
| be83e34f9b | |||
| d5218ca66c | |||
| 78f1ba3c91 | |||
| 719efd50ca | |||
| e92e927f07 | |||
| 7646147f9e | |||
| fdac470f96 | 
					 17 changed files with 377 additions and 95 deletions
				
			
		|  | @ -12,7 +12,7 @@ on: | |||
| 
 | ||||
| jobs: | ||||
|   _checks: | ||||
|     needs: ["deployment-basic","deployment-cli","deployment-model-nixops4","deployment-model-ssh","deployment-model-tf","deployment-model-tf-proxmox","deployment-panel","nixops-deployment-providers-default","nixops-deployment-providers-fedi200","nixops-deployment-providers-fedi201","nixops-deployment-providers-forgejo-ci","nixops-deployment-providers-test","nixops-deployment-providers-vm02116","nixops-deployment-providers-vm02187","nixosConfigurations-fedi200","nixosConfigurations-fedi201","nixosConfigurations-forgejo-ci","nixosConfigurations-test01","nixosConfigurations-test02","nixosConfigurations-test03","nixosConfigurations-test04","nixosConfigurations-test05","nixosConfigurations-test06","nixosConfigurations-test11","nixosConfigurations-test12","nixosConfigurations-test13","nixosConfigurations-test14","nixosConfigurations-vm02116","nixosConfigurations-vm02187","panel","pre-commit","proxmox-basic","test-mastodon-service","test-peertube-service","vmOptions-fedi200","vmOptions-fedi201","vmOptions-test01","vmOptions-test02","vmOptions-test03","vmOptions-test04","vmOptions-test05","vmOptions-test06","vmOptions-test11","vmOptions-test12","vmOptions-test13","vmOptions-test14"] | ||||
|     needs: ["deployment-basic","deployment-cli","deployment-model-nixops4","deployment-model-ssh","deployment-model-tf","deployment-model-tf-proxmox","deployment-panel","nixops-deployment-providers-default","nixops-deployment-providers-fedi201","nixops-deployment-providers-forgejo-ci","nixops-deployment-providers-test","nixops-deployment-providers-vm02116","nixops-deployment-providers-vm02187","nixosConfigurations-fedi201","nixosConfigurations-forgejo-ci","nixosConfigurations-test01","nixosConfigurations-test02","nixosConfigurations-test03","nixosConfigurations-test04","nixosConfigurations-test05","nixosConfigurations-test06","nixosConfigurations-test11","nixosConfigurations-test12","nixosConfigurations-test13","nixosConfigurations-test14","nixosConfigurations-vm02116","nixosConfigurations-vm02187","panel","pre-commit","proxmox-basic","test-mastodon-service","test-peertube-service","vmOptions-fedi201","vmOptions-test01","vmOptions-test02","vmOptions-test03","vmOptions-test04","vmOptions-test05","vmOptions-test06","vmOptions-test11","vmOptions-test12","vmOptions-test13","vmOptions-test14"] | ||||
|     runs-on: native | ||||
|     steps: | ||||
|       - run: true | ||||
|  | @ -71,12 +71,6 @@ jobs: | |||
|       - uses: actions/checkout@v4 | ||||
|       - run: nix build .#checks.x86_64-linux.nixops-deployment-providers-default -vL | ||||
| 
 | ||||
|   nixops-deployment-providers-fedi200: | ||||
|     runs-on: native | ||||
|     steps: | ||||
|       - uses: actions/checkout@v4 | ||||
|       - run: nix build .#checks.x86_64-linux.nixops-deployment-providers-fedi200 -vL | ||||
| 
 | ||||
|   nixops-deployment-providers-fedi201: | ||||
|     runs-on: native | ||||
|     steps: | ||||
|  | @ -107,12 +101,6 @@ jobs: | |||
|       - uses: actions/checkout@v4 | ||||
|       - run: nix build .#checks.x86_64-linux.nixops-deployment-providers-vm02187 -vL | ||||
| 
 | ||||
|   nixosConfigurations-fedi200: | ||||
|     runs-on: native | ||||
|     steps: | ||||
|       - uses: actions/checkout@v4 | ||||
|       - run: nix build .#checks.x86_64-linux.nixosConfigurations-fedi200 -vL | ||||
| 
 | ||||
|   nixosConfigurations-fedi201: | ||||
|     runs-on: native | ||||
|     steps: | ||||
|  | @ -227,12 +215,6 @@ jobs: | |||
|       - uses: actions/checkout@v4 | ||||
|       - run: nix build .#checks.x86_64-linux.test-peertube-service -vL | ||||
| 
 | ||||
|   vmOptions-fedi200: | ||||
|     runs-on: native | ||||
|     steps: | ||||
|       - uses: actions/checkout@v4 | ||||
|       - run: nix build .#checks.x86_64-linux.vmOptions-fedi200 -vL | ||||
| 
 | ||||
|   vmOptions-fedi201: | ||||
|     runs-on: native | ||||
|     steps: | ||||
|  |  | |||
|  | @ -1,24 +0,0 @@ | |||
| name: update-dependencies | ||||
| 
 | ||||
| on: | ||||
|   workflow_dispatch: # allows manual triggering | ||||
|   # FIXME: re-enable when manual run works | ||||
|   # schedule: | ||||
|   #   - cron: '0 0 1 * *' # monthly | ||||
| 
 | ||||
| jobs: | ||||
|   lockfile: | ||||
|     runs-on: native | ||||
|     steps: | ||||
|       - name: Checkout repository | ||||
|         uses: actions/checkout@v4 | ||||
|       - name: Update pins | ||||
|         run: nix-shell --run "npins --verbose update" | ||||
|       - name: Create PR | ||||
|         uses: https://github.com/KiaraGrouwstra/gitea-create-pull-request@f9f80aa5134bc5c03c38f5aaa95053492885b397 | ||||
|         with: | ||||
|           remote-instance-api-version: v1 | ||||
|           token: "${{ secrets.DEPLOY_KEY }}" | ||||
|           branch: npins-update | ||||
|           commit-message: "npins: update sources" | ||||
|           title: "npins: update sources" | ||||
|  | @ -59,6 +59,7 @@ in | |||
|         }; | ||||
|       in | ||||
|       [ | ||||
|         pkgs.which | ||||
|         pkgs.npins | ||||
|         pkgs.nil | ||||
|         (pkgs.callPackage "${sources.agenix}/pkgs/agenix.nix" { }) | ||||
|  |  | |||
|  | @ -3,17 +3,16 @@ | |||
|   pkgs, | ||||
|   modulesPath, | ||||
|   sources, | ||||
|   config, | ||||
|   ... | ||||
| }: | ||||
| let | ||||
|   inherit (pkgs) system; | ||||
|   netboxUser = "netbox"; | ||||
|   netboxPassword = "netbox"; | ||||
|   backendPort = builtins.toString 8080; | ||||
|   tfBackend = fragment: rec { | ||||
|     TF_HTTP_USERNAME = "basic"; | ||||
|     TF_HTTP_PASSWORD = "fake-secret"; | ||||
|     TF_HTTP_LOCK_ADDRESS = TF_HTTP_ADDRESS; | ||||
|     TF_HTTP_UNLOCK_ADDRESS = TF_HTTP_ADDRESS; | ||||
|     TF_HTTP_ADDRESS = "http://localhost:${backendPort}/state/${fragment}"; | ||||
|   tfBackend = fragment: { | ||||
|     address = "http://localhost:${backendPort}/state/${fragment}"; | ||||
|   }; | ||||
|   template-deployment = | ||||
|     (import ./setups/template.nix { | ||||
|  | @ -47,13 +46,45 @@ let | |||
|         vmDatastoreId = "local"; | ||||
|         cdDatastoreId = "local"; | ||||
|         ipv4Gateway = "192.168.10.1"; | ||||
|         ipv4Address = "192.168.10.236/24"; | ||||
|         # ipv4Address = "192.168.10.236/24"; | ||||
|         ipv4Address = null; | ||||
|         ipv6Gateway = ""; | ||||
|         ipv6Address = ""; | ||||
|         # dynamically get the id from the template upload step | ||||
|         templateId = null; | ||||
|       }; | ||||
|     }).default.tf-proxmox-vm; | ||||
|   inherit | ||||
|     (pkgs.callPackage ../../run { | ||||
|       inherit sources system; | ||||
|     }) | ||||
|     tf-netbox-store-ips | ||||
|     tf-netbox-get-ip | ||||
|     ; | ||||
|   netbox-store-ips = | ||||
|     (lib.evalModules { | ||||
|       modules = [ | ||||
|         { | ||||
|           options = { inherit tf-netbox-store-ips; }; | ||||
|           config.tf-netbox-store-ips = { | ||||
|             httpBackend = tfBackend "proxmox-test/store-ips"; | ||||
|             startAddress = "192.168.10.236/24"; | ||||
|             endAddress = "192.168.10.240/24"; | ||||
|           }; | ||||
|         } | ||||
|       ]; | ||||
|     }).config.tf-netbox-store-ips; | ||||
|   netbox-get-ip = | ||||
|     (lib.evalModules { | ||||
|       modules = [ | ||||
|         { | ||||
|           options = { inherit tf-netbox-get-ip; }; | ||||
|           config.tf-netbox-get-ip = { | ||||
|             httpBackend = tfBackend "proxmox-test/get-ip"; | ||||
|           }; | ||||
|         } | ||||
|       ]; | ||||
|     }).config.tf-netbox-get-ip; | ||||
| in | ||||
| { | ||||
|   _class = "nixosTest"; | ||||
|  | @ -129,8 +160,11 @@ in | |||
|         pkgs.pve-manager | ||||
|         pkgs.openssl | ||||
|         pkgs.jq | ||||
|         pkgs.netbox | ||||
|         (pkgs.callPackage ../../run/tf-proxmox-template/tf.nix { }) | ||||
|         (pkgs.callPackage ../../run/tf-proxmox-vm/tf.nix { }) | ||||
|         (pkgs.callPackage ../../run/tf-netbox-store-ips/tf.nix { }) | ||||
|         (pkgs.callPackage ../../run/tf-netbox-get-ip/tf.nix { }) | ||||
|       ]; | ||||
| 
 | ||||
|       # needed only when building from deployer | ||||
|  | @ -162,9 +196,39 @@ in | |||
|           KMS_KEY = "tsjxw9NjKUBUlzbTnD7orqIAdEmpGYRARvxD51jtY+o="; | ||||
|         }; | ||||
|       }; | ||||
|       services.netbox = { | ||||
|         enable = true; | ||||
|         # FIXME randomly generate this | ||||
|         secretKeyFile = pkgs.writeText "netbox-secret" "634da8232803a8155a58584d3186127000207e079d600fc10a890e5cd59c2f4b8f0e0654005944d2ce87f5be9c22ceebec66"; | ||||
|         # listenAddress = "[::1]"; | ||||
|         port = 8001; | ||||
|       }; | ||||
|     }; | ||||
| 
 | ||||
|   extraTestScript = '' | ||||
|     deployer.succeed(""" | ||||
|       DJANGO_SUPERUSER_PASSWORD='${netboxPassword}' netbox-manage createsuperuser --noinput --user '${netboxUser}' --email 'test@domain.tld' >&2 | ||||
|     """) | ||||
|     # FIXME use https | ||||
|     netbox_token = deployer.succeed(""" | ||||
|       resp=$(curl -X POST -H "Content-Type: application/json" -H "Accept: application/json" http://localhost:8001/api/users/tokens/provision/ --data '{"username": "${netboxUser}", "password": "${netboxPassword}" }') | ||||
|       echo "resp: $resp" >&2 | ||||
|       echo $resp | jq .key | ||||
|     """).strip() | ||||
|     deployer.succeed(f""" | ||||
|       export NETBOX_SERVER_URL="localhost:8001" | ||||
|       export NETBOX_API_TOKEN="{netbox_token}" | ||||
|       export NETBOX_ALLOW_INSECURE_HTTPS="true" | ||||
|       # export NETBOX_CA_CERT_FILE="" | ||||
|       ${lib.getExe netbox-store-ips.run} | ||||
|     """) | ||||
|     ipv4 = deployer.succeed(f""" | ||||
|       export NETBOX_SERVER_URL="localhost:8001" | ||||
|       export NETBOX_API_TOKEN="{netbox_token}" | ||||
|       export NETBOX_ALLOW_INSECURE_HTTPS="true" | ||||
|       # export NETBOX_CA_CERT_FILE="" | ||||
|       ${lib.getExe netbox-get-ip.run} | jq -r '.ipv4.value' | ||||
|     """).strip() | ||||
|     pve.wait_for_unit("pveproxy.service") | ||||
|     assert "running" in pve.succeed("pveproxy status") | ||||
|     pve.succeed("mkdir -p /run/pve") | ||||
|  | @ -227,6 +291,7 @@ in | |||
|         export PROXMOX_VE_INSECURE="true" | ||||
|         export SSL_CERT_FILE=/tmp/pve-ca-bundle.crt | ||||
|         export PROXMOX_VE_API_TOKEN="root@pam!template={template_token}" | ||||
|         export TF_VAR_ipv4_address="{ipv4}" | ||||
|         ${lib.getExe template-deployment.run} | jq -r '.id.value' | ||||
|       """).strip() | ||||
| 
 | ||||
|  | @ -237,6 +302,7 @@ in | |||
|       export SSL_CERT_FILE=/tmp/pve-ca-bundle.crt | ||||
|       export PROXMOX_VE_API_TOKEN="root@pam!vm={vm_token}" | ||||
|       export TF_VAR_template_id="{template_id}" | ||||
|       export TF_VAR_ipv4_address="{ipv4}" | ||||
|       ${lib.getExe vm-deployment.run} | jq -r '.ipv4.value[0]' | ||||
|     """ | ||||
| 
 | ||||
|  |  | |||
|  | @ -17,13 +17,7 @@ let | |||
|         inherit nodeName pathToRoot; | ||||
|         targetSystem = system; | ||||
|         sshOpts = [ ]; | ||||
|         httpBackend = rec { | ||||
|           TF_HTTP_USERNAME = "basic"; | ||||
|           TF_HTTP_PASSWORD = "fake-secret"; | ||||
|           TF_HTTP_ADDRESS = "http://localhost:${backendPort}/state/project1/example"; | ||||
|           TF_HTTP_LOCK_ADDRESS = TF_HTTP_ADDRESS; | ||||
|           TF_HTTP_UNLOCK_ADDRESS = TF_HTTP_ADDRESS; | ||||
|         }; | ||||
|         httpBackend.address = "http://localhost:${backendPort}/state/project1/example"; | ||||
|       }; | ||||
|     }).default.tf-host.run; | ||||
| in | ||||
|  |  | |||
|  | @ -74,6 +74,91 @@ let | |||
|     description = "A NixOS configuration."; | ||||
|     type = raw; | ||||
|   }; | ||||
|   httpBackend = mkOption { | ||||
|     description = "environment variables to configure the TF HTTP back-end, see <https://developer.hashicorp.com/terraform/language/backend/http#configuration-variables>"; | ||||
|     type = types.submodule (http-backend: { | ||||
|       options = { | ||||
|         value = mkOption { | ||||
|           readOnly = true; | ||||
|           default = lib.mapAttrs' (k: v: lib.nameValuePair "TF_HTTP_${lib.toUpper k}" (builtins.toString v)) { | ||||
|             inherit (http-backend.config) | ||||
|               address | ||||
|               update_method | ||||
|               lock_address | ||||
|               lock_method | ||||
|               unlock_address | ||||
|               unlock_method | ||||
|               username | ||||
|               password | ||||
|               skip_cert_verification | ||||
|               retry_max | ||||
|               retry_wait_min | ||||
|               retry_wait_max | ||||
|               ; | ||||
|           }; | ||||
|         }; | ||||
|         address = mkOption { | ||||
|           description = "The address of the REST endpoint"; | ||||
|           type = str; | ||||
|         }; | ||||
|         update_method = mkOption { | ||||
|           description = "HTTP method to use when updating state."; | ||||
|           type = str; | ||||
|           default = "POST"; | ||||
|         }; | ||||
|         lock_address = mkOption { | ||||
|           description = "The address of the lock REST endpoint."; | ||||
|           type = str; | ||||
|           default = http-backend.config.address; | ||||
|         }; | ||||
|         lock_method = mkOption { | ||||
|           description = "The HTTP method to use when locking."; | ||||
|           type = str; | ||||
|           default = "LOCK"; | ||||
|         }; | ||||
|         unlock_address = mkOption { | ||||
|           description = "The address of the unlock REST endpoint."; | ||||
|           type = str; | ||||
|           default = http-backend.config.address; | ||||
|         }; | ||||
|         unlock_method = mkOption { | ||||
|           description = "The HTTP method to use when unlocking."; | ||||
|           type = str; | ||||
|           default = "UNLOCK"; | ||||
|         }; | ||||
|         username = mkOption { | ||||
|           description = "The username for HTTP basic authentication."; | ||||
|           type = str; | ||||
|           default = "basic"; | ||||
|         }; | ||||
|         password = mkOption { | ||||
|           description = "The password for HTTP basic authentication."; | ||||
|           type = str; | ||||
|           default = "fake-secret"; | ||||
|         }; | ||||
|         skip_cert_verification = mkOption { | ||||
|           description = "Whether to skip TLS verification."; | ||||
|           type = str; | ||||
|           default = "false"; | ||||
|         }; | ||||
|         retry_max = mkOption { | ||||
|           description = "The number of HTTP request retries."; | ||||
|           type = types.int; | ||||
|           default = 2; | ||||
|         }; | ||||
|         retry_wait_min = mkOption { | ||||
|           description = "The minimum time in seconds to wait between HTTP request attempts."; | ||||
|           type = types.int; | ||||
|           default = 1; | ||||
|         }; | ||||
|         retry_wait_max = mkOption { | ||||
|           description = "The maximum time in seconds to wait between HTTP request attempts."; | ||||
|           type = types.int; | ||||
|           default = 30; | ||||
|         }; | ||||
|       }; | ||||
|     }); | ||||
|   }; | ||||
|   host-ssh = mkOption { | ||||
|     description = "SSH connection info to connect to a single host."; | ||||
|     type = submodule { | ||||
|  | @ -195,7 +280,7 @@ let | |||
|             description = "The architecture of the system to deploy to."; | ||||
|             type = types.str; | ||||
|           }; | ||||
|           inherit nixos-configuration; | ||||
|           inherit httpBackend nixos-configuration; | ||||
|           ssh = host-ssh; | ||||
|           caller = mkOption { | ||||
|             description = "The calling module to obtain the NixOS configuration from."; | ||||
|  | @ -213,10 +298,6 @@ let | |||
|             description = "The path to the root of the repository."; | ||||
|             type = types.path; | ||||
|           }; | ||||
|           httpBackend = mkOption { | ||||
|             description = "environment variables to configure the TF HTTP back-end, see <https://developer.hashicorp.com/terraform/language/backend/http#configuration-variables>"; | ||||
|             type = types.attrsOf (types.either types.str types.int); | ||||
|           }; | ||||
|           run = mkOption { | ||||
|             type = types.package; | ||||
|             # error: The option `tf-deployment.tf-host.run' is read-only, but it's set multiple times. | ||||
|  | @ -278,16 +359,12 @@ let | |||
|             description = "The architecture of the system to deploy to."; | ||||
|             type = types.str; | ||||
|           }; | ||||
|           inherit nixos-configuration; | ||||
|           inherit httpBackend nixos-configuration; | ||||
|           ssh = host-ssh; | ||||
|           node-name = mkOption { | ||||
|             description = "the name of the ProxmoX node to use."; | ||||
|             type = types.str; | ||||
|           }; | ||||
|           httpBackend = mkOption { | ||||
|             description = "environment variables to configure the TF HTTP back-end, see <https://developer.hashicorp.com/terraform/language/backend/http#configuration-variables>"; | ||||
|             type = types.attrsOf (types.either types.str types.int); | ||||
|           }; | ||||
|           imageDatastoreId = mkOption { | ||||
|             description = "ID of the datastore of the image."; | ||||
|             type = types.str; | ||||
|  | @ -366,7 +443,7 @@ let | |||
|             description = "The architecture of the system to deploy to."; | ||||
|             type = types.str; | ||||
|           }; | ||||
|           inherit nixos-configuration; | ||||
|           inherit httpBackend nixos-configuration; | ||||
|           ssh = host-ssh; | ||||
|           caller = mkOption { | ||||
|             description = "The calling module to obtain the NixOS configuration from."; | ||||
|  | @ -388,10 +465,6 @@ let | |||
|             description = "the name of the ProxmoX node to use."; | ||||
|             type = types.str; | ||||
|           }; | ||||
|           httpBackend = mkOption { | ||||
|             description = "environment variables to configure the TF HTTP back-end, see <https://developer.hashicorp.com/terraform/language/backend/http#configuration-variables>"; | ||||
|             type = types.attrsOf (types.either types.str types.int); | ||||
|           }; | ||||
|           bridge = mkOption { | ||||
|             description = "The name of the network bridge (defaults to vmbr0)."; | ||||
|             type = types.str; | ||||
|  | @ -515,6 +588,66 @@ let | |||
|         }; | ||||
|       }); | ||||
|     }; | ||||
|     tf-netbox-store-ips = mkOption { | ||||
|       description = "Store a range of IPs in a Netbox instance."; | ||||
|       type = submodule (tf-netbox-store-ips: { | ||||
|         options = { | ||||
|           inherit httpBackend; | ||||
|           startAddress = mkOption { | ||||
|             description = "Start of the IP range."; | ||||
|             type = types.str; | ||||
|             example = "10.0.0.1/24"; | ||||
|           }; | ||||
|           endAddress = mkOption { | ||||
|             description = "End of the IP range."; | ||||
|             type = types.str; | ||||
|             example = "10.0.0.50/24"; | ||||
|           }; | ||||
|           run = mkOption { | ||||
|             type = types.package; | ||||
|             default = | ||||
|               let | ||||
|                 inherit (tf-netbox-store-ips.config) | ||||
|                   httpBackend | ||||
|                   startAddress | ||||
|                   endAddress | ||||
|                   ; | ||||
|               in | ||||
|               tfApply { | ||||
|                 inherit httpBackend; | ||||
|                 directory = "tf-netbox-store-ips"; | ||||
|                 environment = { | ||||
|                   start_address = startAddress; | ||||
|                   end_address = endAddress; | ||||
|                 }; | ||||
|               }; | ||||
|           }; | ||||
|         }; | ||||
|       }); | ||||
|     }; | ||||
|     tf-netbox-get-ip = mkOption { | ||||
|       description = "Get an available IP from a Netbox instance."; | ||||
|       type = submodule (tf-netbox-get-ip: { | ||||
|         options = { | ||||
|           inherit httpBackend; | ||||
|           run = mkOption { | ||||
|             type = types.package; | ||||
|             default = | ||||
|               let | ||||
|                 inherit (tf-netbox-get-ip.config) | ||||
|                   httpBackend | ||||
|                   ; | ||||
|               in | ||||
|               tfApply { | ||||
|                 inherit httpBackend; | ||||
|                 directory = "tf-netbox-get-ip"; | ||||
|                 environment = { | ||||
|                 }; | ||||
|               }; | ||||
|           }; | ||||
|         }; | ||||
|       }); | ||||
|     }; | ||||
|   }; | ||||
| in | ||||
| { | ||||
|  |  | |||
							
								
								
									
										17
									
								
								deployment/run/tf-netbox-get-ip/main.tf
									
										
									
									
									
										Normal file
									
								
							
							
						
						
									
										17
									
								
								deployment/run/tf-netbox-get-ip/main.tf
									
										
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,17 @@ | |||
| terraform { | ||||
|   required_providers { | ||||
|     netbox = { | ||||
|       source  = "e-breuninger/netbox" | ||||
|       version = "= 5.0.0" | ||||
|     } | ||||
|   } | ||||
|   backend "http" { | ||||
|   } | ||||
| } | ||||
| 
 | ||||
| resource "netbox_available_ip_address" "get_ip" { | ||||
| } | ||||
| 
 | ||||
| output "ipv4" { | ||||
|   value = netbox_available_ip_address.get_ip.ip_address | ||||
| } | ||||
							
								
								
									
										47
									
								
								deployment/run/tf-netbox-get-ip/tf.nix
									
										
									
									
									
										Normal file
									
								
							
							
						
						
									
										47
									
								
								deployment/run/tf-netbox-get-ip/tf.nix
									
										
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,47 @@ | |||
| # FIXME: use overlays so this gets imported just once? | ||||
| { | ||||
|   pkgs, | ||||
| }: | ||||
| # FIXME centralize overlays | ||||
| # XXX using recent revision for https://github.com/NixOS/nixpkgs/pull/447849 | ||||
| let | ||||
|   sources = import ../../../npins; | ||||
|   mkProvider = | ||||
|     args: | ||||
|     pkgs.terraform-providers.mkProvider ( | ||||
|       { mkProviderFetcher = { repo, ... }: sources.${repo}; } // args | ||||
|     ); | ||||
| in | ||||
| ( | ||||
|   (pkgs.callPackage "${sources.nixpkgs-unstable}/pkgs/by-name/op/opentofu/package.nix" { }) | ||||
|   .overrideAttrs | ||||
|   (old: rec { | ||||
|     patches = (old.patches or [ ]) ++ [ | ||||
|       # TF with back-end poses a problem for nix: initialization involves both | ||||
|       # mutation (nix: only inside build) and a network call (nix: not inside build) | ||||
|       ../../check/data-model-tf/02-opentofu-sandboxed-init.patch | ||||
|     ]; | ||||
|     # versions > 1.9.0 need go 1.24+ | ||||
|     version = "1.9.0"; | ||||
|     src = pkgs.fetchFromGitHub { | ||||
|       owner = "opentofu"; | ||||
|       repo = "opentofu"; | ||||
|       tag = "v${version}"; | ||||
|       hash = "sha256-e0ZzbQdex0DD7Bj9WpcVI5roh0cMbJuNr5nsSVaOSu4="; | ||||
|     }; | ||||
|     vendorHash = "sha256-fMTbLSeW+pw6GK8/JLZzG2ER90ss2g1FSDX5+f292do="; | ||||
|   }) | ||||
| ).withPlugins | ||||
|   (_: [ | ||||
|     (mkProvider { | ||||
|       owner = "e-breuninger"; | ||||
|       repo = "terraform-provider-netbox"; | ||||
|       rev = "v5.0.0"; | ||||
|       spdx = "MPL-2.0"; | ||||
|       # hash = "sha256-iCaCt8ZbkxCk43QEyj3PeHYuKPCPVU2oQ78aumH/l6k="; | ||||
|       hash = null; | ||||
|       vendorHash = "sha256-Q3H/6mpkWn1Gw0NRMtKtkBRGHjPJZGBFdGwfalyQ4Z0="; | ||||
|       homepage = "https://registry.terraform.io/providers/e-breuninger/netbox"; | ||||
|       provider-source-address = "registry.opentofu.org/e-breuninger/netbox"; | ||||
|     }) | ||||
|   ]) | ||||
							
								
								
									
										0
									
								
								deployment/run/tf-netbox-get-ip/variables.tf
									
										
									
									
									
										Normal file
									
								
							
							
						
						
									
										0
									
								
								deployment/run/tf-netbox-get-ip/variables.tf
									
										
									
									
									
										Normal file
									
								
							
							
								
								
									
										15
									
								
								deployment/run/tf-netbox-store-ips/main.tf
									
										
									
									
									
										Normal file
									
								
							
							
						
						
									
										15
									
								
								deployment/run/tf-netbox-store-ips/main.tf
									
										
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,15 @@ | |||
| terraform { | ||||
|   required_providers { | ||||
|     netbox = { | ||||
|       source  = "e-breuninger/netbox" | ||||
|       version = "= 5.0.0" | ||||
|     } | ||||
|   } | ||||
|   backend "http" { | ||||
|   } | ||||
| } | ||||
| 
 | ||||
| resource "netbox_ip_range" "ips" { | ||||
|   start_address = var.start_address | ||||
|   end_address   = var.end_address | ||||
| } | ||||
							
								
								
									
										47
									
								
								deployment/run/tf-netbox-store-ips/tf.nix
									
										
									
									
									
										Normal file
									
								
							
							
						
						
									
										47
									
								
								deployment/run/tf-netbox-store-ips/tf.nix
									
										
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,47 @@ | |||
| # FIXME: use overlays so this gets imported just once? | ||||
| { | ||||
|   pkgs, | ||||
| }: | ||||
| # FIXME centralize overlays | ||||
| # XXX using recent revision for https://github.com/NixOS/nixpkgs/pull/447849 | ||||
| let | ||||
|   sources = import ../../../npins; | ||||
|   mkProvider = | ||||
|     args: | ||||
|     pkgs.terraform-providers.mkProvider ( | ||||
|       { mkProviderFetcher = { repo, ... }: sources.${repo}; } // args | ||||
|     ); | ||||
| in | ||||
| ( | ||||
|   (pkgs.callPackage "${sources.nixpkgs-unstable}/pkgs/by-name/op/opentofu/package.nix" { }) | ||||
|   .overrideAttrs | ||||
|   (old: rec { | ||||
|     patches = (old.patches or [ ]) ++ [ | ||||
|       # TF with back-end poses a problem for nix: initialization involves both | ||||
|       # mutation (nix: only inside build) and a network call (nix: not inside build) | ||||
|       ../../check/data-model-tf/02-opentofu-sandboxed-init.patch | ||||
|     ]; | ||||
|     # versions > 1.9.0 need go 1.24+ | ||||
|     version = "1.9.0"; | ||||
|     src = pkgs.fetchFromGitHub { | ||||
|       owner = "opentofu"; | ||||
|       repo = "opentofu"; | ||||
|       tag = "v${version}"; | ||||
|       hash = "sha256-e0ZzbQdex0DD7Bj9WpcVI5roh0cMbJuNr5nsSVaOSu4="; | ||||
|     }; | ||||
|     vendorHash = "sha256-fMTbLSeW+pw6GK8/JLZzG2ER90ss2g1FSDX5+f292do="; | ||||
|   }) | ||||
| ).withPlugins | ||||
|   (_: [ | ||||
|     (mkProvider { | ||||
|       owner = "e-breuninger"; | ||||
|       repo = "terraform-provider-netbox"; | ||||
|       rev = "v5.0.0"; | ||||
|       spdx = "MPL-2.0"; | ||||
|       # hash = "sha256-iCaCt8ZbkxCk43QEyj3PeHYuKPCPVU2oQ78aumH/l6k="; | ||||
|       hash = null; | ||||
|       vendorHash = "sha256-Q3H/6mpkWn1Gw0NRMtKtkBRGHjPJZGBFdGwfalyQ4Z0="; | ||||
|       homepage = "https://registry.terraform.io/providers/e-breuninger/netbox"; | ||||
|       provider-source-address = "registry.opentofu.org/e-breuninger/netbox"; | ||||
|     }) | ||||
|   ]) | ||||
							
								
								
									
										9
									
								
								deployment/run/tf-netbox-store-ips/variables.tf
									
										
									
									
									
										Normal file
									
								
							
							
						
						
									
										9
									
								
								deployment/run/tf-netbox-store-ips/variables.tf
									
										
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,9 @@ | |||
| variable "start_address" { | ||||
|   description = "Start of the IP range, e.g. 10.0.0.1/24." | ||||
|   type = string | ||||
| } | ||||
| 
 | ||||
| variable "end_address" { | ||||
|   description = "End of the IP range, e.g. 10.0.0.50/24." | ||||
|   type = string | ||||
| } | ||||
|  | @ -17,6 +17,6 @@ pkgs.writeScriptBin "setup" '' | |||
|   # suppress warning on architecture-specific generated lock file: | ||||
|   # `Warning: Incomplete lock file information for providers`. | ||||
|   env TF_HTTP_RETRY_MAX=1 TF_HTTP_RETRY_WAIT_MIN=0 \ | ||||
|   ${toString (lib.mapAttrsToList (k: v: "${k}=\"${toBash v}\"") httpBackend)} \ | ||||
|   ${toString (lib.mapAttrsToList (k: v: "${k}=\"${toBash v}\"") httpBackend.value)} \ | ||||
|   tofu init -input=false 1>/dev/null | ||||
| '' | ||||
|  |  | |||
|  | @ -56,7 +56,7 @@ rec { | |||
|             ) | ||||
|           ) | ||||
|         } \ | ||||
|         ${toString (lib.mapAttrsToList (k: v: "${k}=\"${toBash v}\"") httpBackend)} \ | ||||
|         ${toString (lib.mapAttrsToList (k: v: "${k}=\"${toBash v}\"") httpBackend.value)} \ | ||||
|       ''; | ||||
|       tfPackage = pkgs.callPackage ./run/${directory}/tf.nix { }; | ||||
|       tf-env = pkgs.callPackage ./run/tf-env.nix { | ||||
|  |  | |||
|  | @ -1,20 +0,0 @@ | |||
| { | ||||
|   _class = "nixops4Resource"; | ||||
| 
 | ||||
|   fediversityVm = { | ||||
|     name = "fedi200"; | ||||
|     isFediversityVm = true; | ||||
|     vmId = 200; | ||||
|     description = "Testing machine for Hans"; | ||||
| 
 | ||||
|     domain = "abundos.eu"; | ||||
|     ipv4 = { | ||||
|       address = "95.215.187.200"; | ||||
|       gateway = "95.215.187.1"; | ||||
|     }; | ||||
|     ipv6 = { | ||||
|       address = "2a00:51c0:13:1305::200"; | ||||
|       gateway = "2a00:51c0:13:1305::1"; | ||||
|     }; | ||||
|   }; | ||||
| } | ||||
|  | @ -7,7 +7,6 @@ Currently, this repository keeps track of the following VMs: | |||
| 
 | ||||
| Machine | Proxmox | Description | ||||
| --------|---------|------------- | ||||
| [`fedi200`](./dev/fedi200) | fediversity | Testing machine for Hans | ||||
| [`fedi201`](./dev/fedi201) | fediversity | FediPanel | ||||
| [`vm02116`](./dev/vm02116) | procolix | Forgejo | ||||
| [`vm02187`](./dev/vm02187) | procolix | Wiki | ||||
|  |  | |||
|  | @ -206,6 +206,22 @@ | |||
|       "url": "https://github.com/SaumonNet/proxmox-nixos/archive/ce8768f43b4374287cd8b88d8fa9c0061e749d9a.tar.gz", | ||||
|       "hash": "116zplxh64wxbq81wsfkmmssjs1l228kvhxfi9d434xd54k6vr35" | ||||
|     }, | ||||
|     "terraform-provider-netbox": { | ||||
|       "type": "GitRelease", | ||||
|       "repository": { | ||||
|         "type": "GitHub", | ||||
|         "owner": "e-breuninger", | ||||
|         "repo": "terraform-provider-netbox" | ||||
|       }, | ||||
|       "pre_releases": false, | ||||
|       "version_upper_bound": null, | ||||
|       "release_prefix": null, | ||||
|       "submodules": false, | ||||
|       "version": "v5.0.0", | ||||
|       "revision": "40184568f1e7a626b44d5887d7d298866204733d", | ||||
|       "url": "https://api.github.com/repos/e-breuninger/terraform-provider-netbox/tarball/v5.0.0", | ||||
|       "hash": "1acpzxhvl6mz8fl4smcgy0l2wxkqrwywl13lwfj114svqsvq49l8" | ||||
|     }, | ||||
|     "terraform-provider-proxmox": { | ||||
|       "type": "Git", | ||||
|       "repository": { | ||||
|  |  | |||
		Loading…
	
	Add table
		
		Reference in a new issue