From 196dc999dbc1a2e98800312ca9f5edb50ff6bdd5 Mon Sep 17 00:00:00 2001 From: arcnmx Date: Sat, 27 Jan 2024 20:16:54 -0800 Subject: [PATCH] feat(tf): prox --- devShell.nix | 4 ++ packages/default.nix | 10 ++++ systems/default.nix | 4 +- systems/reisen/bin/lxc-config.sh | 48 ++++++++++++++++++ systems/reisen/bin/putfile64.sh | 34 +++++++++++++ systems/reisen/bin/pve.sh | 16 ++++++ systems/reisen/bin/setup.sh | 26 ++++++++++ systems/reisen/default.nix | 3 ++ systems/reisen/sysctl.50-net.conf | 3 ++ systems/reisen/udev.90-dri.rules | 1 + systems/reisen/udev.90-z2m.rules | 1 + tf/.terraform.lock.hcl | 19 ++++++++ tf/proxmox_provider.tf | 81 +++++++++++++++++++++++++++++++ tf/proxmox_reisen.tf | 29 +++++++++++ tf/terraform.tf | 12 +++-- tf/terraform.tfvars.sops | 6 +-- 16 files changed, 288 insertions(+), 9 deletions(-) create mode 100644 systems/reisen/bin/lxc-config.sh create mode 100644 systems/reisen/bin/putfile64.sh create mode 100644 systems/reisen/bin/pve.sh create mode 100644 systems/reisen/bin/setup.sh create mode 100644 systems/reisen/default.nix create mode 100644 systems/reisen/sysctl.50-net.conf create mode 100644 systems/reisen/udev.90-dri.rules create mode 100644 systems/reisen/udev.90-z2m.rules create mode 100644 tf/proxmox_reisen.tf diff --git a/devShell.nix b/devShell.nix index bbbd1a32..966aad2b 100644 --- a/devShell.nix +++ b/devShell.nix @@ -22,6 +22,9 @@ nf-deploy = pkgs.writeShellScriptBin "nf-deploy" '' exec nix run ''${FLAKE_OPTS-} "$NF_CONFIG_ROOT#nf-deploy" -- "$@" ''; + nf-setup-reisen = pkgs.writeShellScriptBin "nf-setup-reisen" '' + exec nix run ''${FLAKE_OPTS-} "$NF_CONFIG_ROOT#nf-setup-reisen" -- "$@" + ''; nf-tf = pkgs.writeShellScriptBin "nf-tf" '' cd "$NF_CONFIG_ROOT/tf" if [[ $# -eq 0 ]]; then @@ -73,6 +76,7 @@ in nf-actions-test nf-update nf-deploy + nf-setup-reisen nf-tf nf-lint-tf nf-lint-nix diff --git a/packages/default.nix b/packages/default.nix index a25d1f39..c7db4e88 100644 --- a/packages/default.nix +++ b/packages/default.nix @@ -17,6 +17,16 @@ nf-deploy = pkgs.writeShellScriptBin "nf-deploy" '' exec ${pkgs.runtimeShell} ${../ci/deploy.sh} "$@" ''; + nf-setup-reisen = let + bin = ../../systems/reisen/bin; + in pkgs.writeShellScriptBin "nf-setup-reisen" '' + ssh root@reisen env \ + INPUT_INFRA_SETUP="$(base64 -w0 < ${bin + "/setup.sh"})" \ + INPUT_INFRA_PUTFILE64="$(base64 -w0 < ${bin + "/putfile64.sh"})" \ + INPUT_INFRA_PVE="$(base64 -w0 < ${bin + "/pve.sh"})" \ + INPUT_INFRA_LXC_CONFIG="$(base64 -w0 < ${bin + "/lxc-config.sh"})" \ + "bash -c \"eval \\\"\\\$(base64 -d <<<\\\$INPUT_INFRA_SETUP)\\\"\"" + ''; nf-statix = pkgs.writeShellScriptBin "nf-statix" '' if [[ $# -eq 0 ]]; then set -- check diff --git a/systems/default.nix b/systems/default.nix index 6b202f00..102f3943 100644 --- a/systems/default.nix +++ b/systems/default.nix @@ -31,7 +31,7 @@ }; type = mkOption { description = "Operating system type of the host"; - type = str; + type = nullOr str; default = "NixOS"; }; folder = mkOption { @@ -141,7 +141,7 @@ (set.map (_: c: c) tree.systems); processHost = name: cfg: let host = cfg.config; - in { + in set.optional (host.type != null) { deploy.nodes.${name} = host.deploy; "${host.folder}Configurations".${name} = host.builder { diff --git a/systems/reisen/bin/lxc-config.sh b/systems/reisen/bin/lxc-config.sh new file mode 100644 index 00000000..85376446 --- /dev/null +++ b/systems/reisen/bin/lxc-config.sh @@ -0,0 +1,48 @@ +#!/usr/bin/env bash +set -eu +shopt -s extglob + +ARG_VMID=$1 +shift + +case "$ARG_VMID" in + +([0-9])) + ;; + *) + echo unknown vmid "$ARG_VMID" >&2 + exit 1 + ;; +esac + +LXC_CONF_PATH="/etc/pve/lxc/$ARG_VMID.conf" + +if [[ ! -e $LXC_CONF_PATH ]]; then + echo missing vmid "$ARG_VMID" >&2 + exit 1 +fi + +ARG_VARS=("$@") + +EXCLUDE_KEYS=( + -e "^lxc\\." +) + +while [[ $# -gt 0 ]]; do + ARG_VAR="$1" + ARG_VALUE="$2" + shift 2 + EXCLUDE_KEYS+=( + -e "^${ARG_VAR//./\\.}:" + ) +done +set -- "${ARG_VARS[@]}" + +LXC_CONF=$(grep -v "${EXCLUDE_KEYS[@]}" "$LXC_CONF_PATH") + +cat > "$LXC_CONF_PATH" <<<"$LXC_CONF" +while [[ $# -gt 0 ]]; do + ARG_VAR="$1" + ARG_VALUE="$2" + shift 2 + echo "$ARG_VAR: $ARG_VALUE" +done >> "$LXC_CONF_PATH" diff --git a/systems/reisen/bin/putfile64.sh b/systems/reisen/bin/putfile64.sh new file mode 100644 index 00000000..e3e6660e --- /dev/null +++ b/systems/reisen/bin/putfile64.sh @@ -0,0 +1,34 @@ +#!/usr/bin/env bash +set -eu + +ARG_DEST=$1 +ARG_INPUT_BASE64=$2 + +case "$ARG_DEST" in + *..*) + echo ugh >&2 + exit 1 + ;; + /etc/sysctl.d/*.conf) + ARG_IS_SYSCTL=1 + ;; + /etc/udev/rules.d/*.rules) + ARG_IS_UDEV=1 + ;; + *) + echo unsupported destination >&2 + exit 1 + ;; +esac + +base64 -d <<<"$ARG_INPUT_BASE64" \ + > "$ARG_DEST" + +if [[ -n ${ARG_IS_SYSCTL-} ]]; then + sysctl -f "$ARG_DEST" +fi + +if [[ -n ${ARG_IS_UDEV-} ]]; then + udevadm control --reload-rules + udevadm trigger +fi diff --git a/systems/reisen/bin/pve.sh b/systems/reisen/bin/pve.sh new file mode 100644 index 00000000..2c1d120b --- /dev/null +++ b/systems/reisen/bin/pve.sh @@ -0,0 +1,16 @@ +#!/usr/bin/env bash +set -eu + +ARG_CMD=$1 +shift + +case "$ARG_CMD" in + qm|pct|pveum) + ;; + *) + echo unsupported pve command "$ARG_CMD" >&2 + exit 1 + ;; +esac + +exec "$ARG_CMD" "$@" diff --git a/systems/reisen/bin/setup.sh b/systems/reisen/bin/setup.sh new file mode 100644 index 00000000..5825660f --- /dev/null +++ b/systems/reisen/bin/setup.sh @@ -0,0 +1,26 @@ +#!/usr/bin/env bash +set -eu + +if [[ ! -d /home/tf ]]; then + echo setting up pve terraform user... >&2 + groupadd -g 1001 tf + useradd -u 1001 -g 1001 -d /home/tf -s /bin/bash tf + passwd tf + pveum user add tf@pam --firstname Terraform --lastname Cloud + pveum acl modify / --users tf@pam --roles PVEVMAdmin + mkdir -p /home/tf/.ssh + cat > /home/tf/.ssh/authorized_keys <<<"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBFobUpp90cBjtqBfHlw49WohhLFeExAmOmHOnCentx+ hakurei-tf-proxmox" + chown -R tf:tf /home/tf + chmod -R og= /home/tf/.ssh +fi + +mkdir -p /opt/infra/bin +base64 -d > /opt/infra/bin/putfile64 <<<"$INPUT_INFRA_PUTFILE64" +base64 -d > /opt/infra/bin/pve <<<"$INPUT_INFRA_PVE" +base64 -d > /opt/infra/bin/lxc-config <<<"$INPUT_INFRA_LXC_CONFIG" +chmod u+x /opt/infra/bin/* +chmod og-rwx /opt/infra/bin/* + +cat > /etc/sudoers.d/tf <