survey.nixos.org: Initial terraform config
Eelco Dolstra committed
Jan 25, 2022 at 15:24 UTC
3cafbbb44a67e88c1226096a228fb6400190566b
6 files changed
+207
-2
ssh-keys.nix
-2
@@ -6,8 +6,6 @@
6
7
provisioner = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKDSfHu0xHu2qtWjmCC92rTMZfwZNKXrsJvPCLSoWtzR eelco.dolstra@deploy";
8
9
- danny = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDlxgNIC4HbyLXB7jexKOEDkMRmiIfDnjOrx445otnR7w87hAehq8If+lnfK/ezGbss6yuWpTjjlc9gi03AxxL9KJW+xAe8avoC36/EeFfBJtRFMaUTjZ0XrcW09Yl8b9BWKypOXSOoF5JAJjV3yI160p+bzhSa584gY+Gj6A2SkVpnUPQfahm3gj0esqVBYVHfN1KXsHq8S89RxOr9HrRU5mTyZn0xO6YE3w+PG2f77vBhZMutt2+28xcMZCNO0HyY/WkWZo7tmJB/HLEENzz1OYiYCXjSEAgEgMbx69kG8r2fOLkrpbKLc/Wbg6fMsi7DM2G5egFPAEqxF1HXHf9T dan@dans-mbp.ws.tudelft.net";
10
-
9
hydra-queue-runner = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCyM48VC5fpjJssLI8uolFscP4/iEoMHfkPoT9R3iE3OEjadmwa1XCAiXUoa7HSshw79SgPKF2KbGBPEVCascdAcErZKGHeHUzxj7v3IsNjObouUOBbJfpN4DR7RQT28PZRsh3TvTWjWnA9vIrSY/BvAK1uezFRuObvatqAPMrw4c0DK+JuGuCNkKDGHLXNSxYBc5Pmr1oSU7/BDiHVjjyLIsAMIc20+q8SjWswKqL1mY193mN7FpUMBtZrd0Za9fMFRII9AofEIDTOayvOZM6+/1dwRWZXM6jhE6kaPPF++yromHvDPBnd6FfwODKLvSF9BkA3pO5CqrD8zs7ETmrV hydra-queue-runner@chef";
10
11
graham = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILBPW2syaEH82DrqIl8/7/ypTgyfK8CRRTBEA4AmMB1l grahamc@nixos";
survey/README.md
new
+9
@@ -0,0 +1,9 @@
1
+# survey.nixos.org
2
+
3
+A temporary machine for running the Nix community survey.
4
+
5
+## Deploy
6
+
7
+To deploy new changes, use `terraform apply` from a trusted machine.
8
+
9
+The NixOS configuration is deployed from the machine itself.
survey/flake.lock
new
+26
@@ -0,0 +1,26 @@
1
+{
2
+ "nodes": {
3
+ "nixpkgs": {
4
+ "locked": {
5
+ "lastModified": 1639161226,
6
+ "narHash": "sha256-75Y08ynJDTq6HHGIF+8IADBJSVip0UyWQH7jqSFnRR8=",
7
+ "owner": "NixOS",
8
+ "repo": "nixpkgs",
9
+ "rev": "573095944e7c1d58d30fc679c81af63668b54056",
10
+ "type": "github"
11
+ },
12
+ "original": {
13
+ "id": "nixpkgs",
14
+ "ref": "nixos-21.11",
15
+ "type": "indirect"
16
+ }
17
+ },
18
+ "root": {
19
+ "inputs": {
20
+ "nixpkgs": "nixpkgs"
21
+ }
22
+ }
23
+ },
24
+ "root": "root",
25
+ "version": 7
26
+}
survey/flake.nix
new
+23
@@ -0,0 +1,23 @@
1
+{
2
+ inputs.nixpkgs.url = "nixpkgs/nixos-21.11";
3
+
4
+ outputs = flakes @ { self, nixpkgs }: {
5
+ nixosConfigurations.survey = nixpkgs.lib.nixosSystem {
6
+ system = "x86_64-linux";
7
+ modules = [ (import ./configuration.nix flakes) ];
8
+ };
9
+
10
+ devShell.x86_64-linux =
11
+ with nixpkgs.legacyPackages.x86_64-linux;
12
+ mkShell {
13
+ nativeBuildInputs = [
14
+ awscli
15
+ (terraform_0_15.withPlugins (p: with p; [ aws p.null external tls local ]))
16
+ ];
17
+
18
+ shellHook = ''
19
+ alias tf=terraform
20
+ '';
21
+ };
22
+ };
23
+}
survey/survey.tf
new
+131
@@ -0,0 +1,131 @@
1
+locals {
2
+ region = "eu-west-1"
3
+}
4
+
5
+output "public_ip" {
6
+ #value = aws_instance.survey.public_ip
7
+ value = aws_eip.survey.public_ip
8
+}
9
+
10
+resource "aws_vpc" "survey" {
11
+ cidr_block = "10.0.0.0/16"
12
+ enable_dns_hostnames = true
13
+ enable_dns_support = true
14
+ enable_classiclink = "false"
15
+ instance_tenancy = "default"
16
+
17
+ tags = {
18
+ "Name" = "survey.nixos.org"
19
+ }
20
+}
21
+
22
+resource "aws_subnet" "survey" {
23
+ vpc_id = aws_vpc.survey.id
24
+ cidr_block = "10.0.0.0/19"
25
+ map_public_ip_on_launch = true
26
+ availability_zone = "eu-west-1a"
27
+
28
+ tags = {
29
+ "Name" = "survey.nixos.org"
30
+ }
31
+}
32
+
33
+resource "aws_route_table" "survey" {
34
+ vpc_id = aws_vpc.survey.id
35
+ route {
36
+ cidr_block = "0.0.0.0/0"
37
+ gateway_id = aws_internet_gateway.survey.id
38
+ }
39
+}
40
+
41
+resource "aws_internet_gateway" "survey" {
42
+ vpc_id = aws_vpc.survey.id
43
+
44
+ tags = {
45
+ "Name" = "survey.nixos.org"
46
+ }
47
+}
48
+
49
+resource "aws_route_table_association" "survey" {
50
+ subnet_id = aws_subnet.survey.id
51
+ route_table_id = aws_route_table.survey.id
52
+}
53
+
54
+resource "aws_security_group" "survey" {
55
+ name = "survey-sg"
56
+ description = "survey.nixos.org"
57
+ vpc_id = aws_vpc.survey.id
58
+
59
+ ingress {
60
+ from_port = 22
61
+ to_port = 22
62
+ protocol = "tcp"
63
+ cidr_blocks = [ "0.0.0.0/0" ]
64
+ }
65
+
66
+ ingress {
67
+ from_port = 80
68
+ to_port = 80
69
+ protocol = "tcp"
70
+ cidr_blocks = [ "0.0.0.0/0" ]
71
+ }
72
+
73
+ ingress {
74
+ from_port = 443
75
+ to_port = 443
76
+ protocol = "tcp"
77
+ cidr_blocks = [ "0.0.0.0/0" ]
78
+ }
79
+
80
+ egress {
81
+ from_port = 0
82
+ to_port = 0
83
+ protocol = "-1"
84
+ cidr_blocks = ["0.0.0.0/0"]
85
+ }
86
+}
87
+
88
+resource "aws_eip" "survey" {
89
+ instance = aws_instance.survey.id
90
+ vpc = true
91
+}
92
+
93
+resource "aws_instance" "survey" {
94
+ ami = "ami-01d0304a712f2f3f0"
95
+ instance_type = "t3a.xlarge"
96
+ subnet_id = aws_subnet.survey.id
97
+
98
+ vpc_security_group_ids = [ aws_security_group.survey.id ]
99
+ key_name = aws_key_pair.generated_key.key_name
100
+
101
+ root_block_device {
102
+ tags = {
103
+ "Name" = "survey.nixos.org"
104
+ "Owners" = "edolstra@gmail.com, rok@garbas.si"
105
+ }
106
+ volume_size = 50
107
+ }
108
+
109
+ tags = {
110
+ "Name" = "survey.nixos.org"
111
+ }
112
+
113
+ lifecycle {
114
+ ignore_changes = [ami]
115
+ }
116
+}
117
+
118
+resource "tls_private_key" "state_ssh_key" {
119
+ algorithm = "RSA"
120
+}
121
+
122
+resource "local_file" "machine_ssh_key" {
123
+ sensitive_content = tls_private_key.state_ssh_key.private_key_pem
124
+ filename = "${path.module}/id_rsa.pem"
125
+ file_permission = "0600"
126
+}
127
+
128
+resource "aws_key_pair" "generated_key" {
129
+ key_name = "generated-key-${sha256(tls_private_key.state_ssh_key.public_key_openssh)}"
130
+ public_key = tls_private_key.state_ssh_key.public_key_openssh
131
+}
survey/terraform.tf
new
+18
@@ -0,0 +1,18 @@
1
+terraform {
2
+ backend "s3" {
3
+ bucket = "nixos-terraform-state"
4
+ encrypt = true
5
+ key = "targets/survey"
6
+ region = "eu-west-1"
7
+ }
8
+
9
+ required_providers {
10
+ aws = {
11
+ source = "hashicorp/aws"
12
+ }
13
+ }
14
+}
15
+
16
+provider "aws" {
17
+ region = "eu-west-1"
18
+}