bastion: move all the EC2 resources to Terraform
All the resources have been imported in the terraform state and have a clean plan.
zimbatm committed
Sep 7, 2021 at 22:52 UTC
6f0fed541e43e1537943404bb662f67943ca67dd
4 files changed
+170
-129
bastion/bastion.tf
new
+141
@@ -0,0 +1,141 @@
1
+locals {
2
+ region = "eu-west-1"
3
+ zone = "eu-west-1a"
4
+}
5
+
6
+resource "aws_vpc" "bastion" {
7
+ cidr_block = "10.0.0.0/16"
8
+ enable_dns_hostnames = true
9
+ enable_dns_support = true
10
+ instance_tenancy = "default"
11
+
12
+ tags = {
13
+ "CharonMachineName" = "bastion-vpc"
14
+ "CharonNetworkName" = "nixos-bastion"
15
+ "CharonNetworkUUID" = "d48ef0d9-7bb1-11e8-8c41-507b9defcdfc"
16
+ "CharonStateFile" = "deploy@bastion:/home/deploy/.nixops/deployments.nixops"
17
+ "Name" = "Unnamed NixOps network [bastion-vpc]"
18
+ }
19
+}
20
+
21
+resource "aws_subnet" "bastion" {
22
+ vpc_id = aws_vpc.bastion.id
23
+ cidr_block = "10.0.0.0/19"
24
+ map_public_ip_on_launch = true
25
+
26
+ tags = {
27
+ "CharonMachineName" = "bastion-subnet"
28
+ "CharonNetworkName" = "nixos-bastion"
29
+ "CharonNetworkUUID" = "d48ef0d9-7bb1-11e8-8c41-507b9defcdfc"
30
+ "CharonStateFile" = "deploy@bastion:/home/deploy/.nixops/deployments.nixops"
31
+ "Name" = "Unnamed NixOps network [bastion-subnet]"
32
+ }
33
+}
34
+
35
+resource "aws_route_table" "bastion" {
36
+ vpc_id = aws_vpc.bastion.id
37
+ route = []
38
+}
39
+
40
+resource "aws_internet_gateway" "bastion" {
41
+ vpc_id = aws_vpc.bastion.id
42
+
43
+ tags = {
44
+ "CharonMachineName" = "bastion-igw"
45
+ "CharonNetworkName" = "nixos-bastion"
46
+ "CharonNetworkUUID" = "d48ef0d9-7bb1-11e8-8c41-507b9defcdfc"
47
+ "CharonStateFile" = "deploy@bastion:/home/deploy/.nixops/deployments.nixops"
48
+ }
49
+}
50
+
51
+resource "aws_security_group" "bastion" {
52
+ name = "charon-d48ef0d9-7bb1-11e8-8c41-507b9defcdfc-bastion-sg"
53
+ description = "NixOps-provisioned group bastion-sg"
54
+ vpc_id = aws_vpc.bastion.id
55
+
56
+ egress = [
57
+ {
58
+ cidr_blocks = ["0.0.0.0/0"]
59
+ description = ""
60
+ from_port = 0
61
+ ipv6_cidr_blocks = []
62
+ prefix_list_ids = []
63
+ protocol = "-1"
64
+ security_groups = []
65
+ self = false
66
+ to_port = 0
67
+ },
68
+ ]
69
+
70
+ ingress = [
71
+ {
72
+ cidr_blocks = ["0.0.0.0/0"]
73
+ description = ""
74
+ from_port = 51820
75
+ ipv6_cidr_blocks = []
76
+ prefix_list_ids = []
77
+ protocol = "udp"
78
+ security_groups = []
79
+ self = false
80
+ to_port = 51820
81
+ },
82
+ ]
83
+
84
+ timeouts {}
85
+
86
+ lifecycle {
87
+ # User IPs are manually added to the security group.
88
+ ignore_changes = [ingress]
89
+ }
90
+}
91
+
92
+resource "aws_instance" "bastion" {
93
+ ami = "ami-cda4fab4"
94
+ instance_type = "t3.xlarge"
95
+ subnet_id = aws_subnet.bastion.id
96
+ disable_api_termination = true
97
+
98
+ # TODO(zimbatm): move that to a aws_ebs_volume + aws_volume_attachment
99
+ ebs_block_device {
100
+ delete_on_termination = false
101
+ device_name = "/dev/sdh"
102
+ tags = {
103
+ "CharonMachineName" = "scratch"
104
+ "CharonNetworkName" = "nixos-bastion"
105
+ "CharonNetworkUUID" = "d48ef0d9-7bb1-11e8-8c41-507b9defcdfc"
106
+ "CharonStateFile" = "deploy@bastion:/home/deploy/.nixops/deployments.nixops"
107
+ "Name" = "Scratch space for the channel generator"
108
+ }
109
+ volume_size = 64
110
+ volume_type = "standard"
111
+ }
112
+
113
+ root_block_device {
114
+ iops = 300
115
+ tags = {
116
+ "Name" = "Unnamed NixOps network [bastion - /dev/xvda1]"
117
+ "Owners" = "edolstra@gmail.com, rob.vermaas@gmail.com"
118
+ }
119
+ volume_size = 100
120
+ volume_type = "gp2"
121
+ }
122
+
123
+ tags = {
124
+ "CharonMachineName" = "bastion"
125
+ "CharonNetworkName" = "nixos-bastion"
126
+ "CharonNetworkUUID" = "d48ef0d9-7bb1-11e8-8c41-507b9defcdfc"
127
+ "CharonStateFile" = "deploy@bastion:/home/deploy/.nixops/deployments.nixops"
128
+ "Name" = "NixOS.org Infrastructure Deployment Server"
129
+ "Owners" = "edolstra@gmail.com, rob.vermaas@gmail.com"
130
+ }
131
+
132
+ lifecycle {
133
+ # FIXME(zimbatm): I'm not sure why, the user_data changes on every plan.
134
+ ignore_changes = [user_data]
135
+ }
136
+}
137
+
138
+resource "aws_eip" "bastion" {
139
+ instance = aws_instance.bastion.id
140
+ vpc = true
141
+}
bastion/flake.nix
+11
-3
@@ -12,9 +12,17 @@
12
modules = [ (import ./configuration.nix flakes) ];
13
};
14
15
- nixopsConfigurations.default =
16
- { inherit nixpkgs; }
17
- // import ./network.nix flakes;
15
+ devShell.x86_64-linux =
16
+ with nixpkgs.legacyPackages.x86_64-linux;
17
+ mkShell {
18
+ nativeBuildInputs = [
19
+ awscli
20
+ (terraform_0_15.withPlugins (p: with p; [ aws p.null external ]))
21
+ ];
22
23
+ shellHook = ''
24
+ alias tf=terraform
25
+ '';
26
+ };
27
};
28
}
bastion/network.nix
deleted
-126
@@ -1,126 +0,0 @@
1
-flakes @ { self, nixpkgs, nix, nixops, nixos-channel-scripts }:
2
-
3
-let
4
- region = "eu-west-1";
5
- zone = "eu-west-1a";
6
- accessKeyId = ""; # FIXME
7
- sshKeys = import ../ssh-keys.nix;
8
-in
9
-
10
-{
11
- resources.ec2KeyPairs.default =
12
- { inherit region accessKeyId;
13
- };
14
-
15
- resources.vpc.bastion-vpc =
16
- {
17
- inherit region accessKeyId;
18
- instanceTenancy = "default";
19
- enableDnsSupport = true;
20
- enableDnsHostnames = true;
21
- cidrBlock = "10.0.0.0/16";
22
- };
23
-
24
- resources.vpcSubnets.bastion-subnet =
25
- { resources, lib, ... }:
26
- {
27
- inherit region zone accessKeyId;
28
- vpcId = resources.vpc.bastion-vpc;
29
- cidrBlock = "10.0.0.0/19";
30
- mapPublicIpOnLaunch = true;
31
- };
32
-
33
- resources.ec2SecurityGroups.bastion-sg =
34
- { resources, lib, ... }:
35
- {
36
- inherit region accessKeyId;
37
- vpcId = resources.vpc.bastion-vpc;
38
- rules =
39
- [
40
- {
41
- fromPort = 51820;
42
- toPort = 51820;
43
- sourceIp = "0.0.0.0/0";
44
- protocol = "udp";
45
- }
46
- ] ++
47
- (with import /home/deploy/src/nixos-org-configurations/ip-addresses.nix; # FIXME
48
- map
49
- (ip: { toPort = 22; fromPort = 22; sourceIp = "${ip}/32"; })
50
- [ eelcoHome
51
- eelcoEC2
52
- rob
53
- graham
54
- zimbatm
55
- amine
56
- "34.254.208.229" # == resources.elasticIPs."bastion.nixos.org".address FIXME: doesn't work
57
- ]);
58
- };
59
-
60
- resources.vpcRouteTables.bastion-route-table =
61
- { resources, ... }:
62
- {
63
- inherit region accessKeyId;
64
- vpcId = resources.vpc.bastion-vpc;
65
- };
66
-
67
- resources.vpcRouteTableAssociations.bastion-assoc =
68
- { resources, ... }:
69
- {
70
- inherit region accessKeyId;
71
- subnetId = resources.vpcSubnets.bastion-subnet;
72
- routeTableId = resources.vpcRouteTables.bastion-route-table;
73
- };
74
-
75
- resources.vpcInternetGateways.bastion-igw =
76
- { resources, ... }:
77
- {
78
- inherit region accessKeyId;
79
- vpcId = resources.vpc.bastion-vpc;
80
- };
81
-
82
- resources.vpcRoutes.bastion-route =
83
- { resources, ... }:
84
- {
85
- inherit region accessKeyId;
86
- routeTableId = resources.vpcRouteTables.bastion-route-table;
87
- destinationCidrBlock = "0.0.0.0/0";
88
- gatewayId = resources.vpcInternetGateways.bastion-igw;
89
- };
90
-
91
- resources.elasticIPs."bastion.nixos.org" =
92
- { inherit region accessKeyId;
93
- vpc = true;
94
- };
95
-
96
- resources.ebsVolumes.scratch =
97
- { tags.Name = "Scratch space for the channel generator";
98
- inherit region zone accessKeyId;
99
- size = 64;
100
- };
101
-
102
- bastion =
103
- { config, lib, pkgs, resources, ... }:
104
-
105
- { deployment.targetEnv = "ec2";
106
- deployment.ec2.tags.Name = "NixOS.org Infrastructure Deployment Server";
107
- deployment.owners = [ "edolstra@gmail.com" "rob.vermaas@gmail.com" ];
108
- deployment.ec2.region = region;
109
- deployment.ec2.zone = zone;
110
- deployment.ec2.instanceType = "t3.xlarge";
111
- deployment.ec2.accessKeyId = accessKeyId;
112
- deployment.ec2.keyPair = resources.ec2KeyPairs.default;
113
- deployment.ec2.securityGroups = [];
114
- deployment.ec2.securityGroupIds = [ resources.ec2SecurityGroups.bastion-sg.name ];
115
- deployment.ec2.subnetId = resources.vpcSubnets.bastion-subnet;
116
- deployment.ec2.associatePublicIpAddress = true;
117
- deployment.ec2.ebsInitialRootDiskSize = 40;
118
- deployment.ec2.elasticIPv4 = resources.elasticIPs."bastion.nixos.org";
119
-
120
- imports = [ self.nixosConfigurations.bastion ];
121
-
122
- fileSystems."/scratch" = {
123
- ec2.disk = resources.ebsVolumes.scratch;
124
- };
125
- };
126
-}
bastion/terraform.tf
new
+18
@@ -0,0 +1,18 @@
1
+terraform {
2
+ backend "s3" {
3
+ bucket = "nixos-terraform-state"
4
+ encrypt = true
5
+ key = "targets/bastion"
6
+ region = "eu-west-1"
7
+ }
8
+
9
+ required_providers {
10
+ aws = {
11
+ source = "hashicorp/aws"
12
+ }
13
+ }
14
+}
15
+
16
+provider "aws" {
17
+ region = "eu-west-1"
18
+}