@cryptotaxi247 / infra / commits / facce226

remove the unused bastion config

We haven't been running a bastion host for a while now

zimbatm committed May 30, 2024 at 18:35 UTC facce226be65f1f667855599695c7cb1177daca3
16 files changed +2 -577
.github/CODEOWNERS
-1
@@ -1,7 +1,6 @@
1 # Every directory containing configurations impacting the core infra needs a
2 # review from a member of core infra.
3 /.github/ @NixOS/infra-build
4 -/bastion/ @NixOS/infra-build
4 /delft/ @NixOS/infra-build
5 /hydra-packet-importer/ @NixOS/infra-build
6 /lib/ @NixOS/infra-build
bastion/.terraform.lock.hcl deleted
-23
@@ -1,23 +0,0 @@
1 -# This file is maintained automatically by "terraform init".
2 -# Manual edits may be lost in future updates.
3 -
4 -provider "registry.terraform.io/hashicorp/aws" {
5 - version = "4.15.1"
6 - hashes = [
7 - "h1:o1hluUxq6rc/CM0h9p7ACQKpJKFGRolbOLx6IZ3mfOg=",
8 - ]
9 -}
10 -
11 -provider "registry.terraform.io/hashicorp/external" {
12 - version = "2.2.2"
13 - hashes = [
14 - "h1:UU5H/RyUmr/JhIc4o9X/2vrlO8BfSWFltDtj5GIZooQ=",
15 - ]
16 -}
17 -
18 -provider "registry.terraform.io/hashicorp/null" {
19 - version = "3.1.1"
20 - hashes = [
21 - "h1:4WUGhW268Uv97mdqfDLH8UyuTcw3iOLiomBWMM6MJhI=",
22 - ]
23 -}
bastion/README.md deleted
-17
@@ -1,17 +0,0 @@
1 -# Bastion
2 -
3 -The entry-point to our infra. Welcome.
4 -
5 -## Deploy
6 -
7 -To deploy new changes, use `AWS_PROFILE=lb-nixos terraform apply` from a trusted machine.
8 -
9 -## Fallback
10 -
11 -In case terraform is broken, run the `./deploy.sh` script from a NixOS
12 -machine. It depends on `nixos-rebuild` under the hood.
13 -
14 -## Common issues
15 -
16 -* make sure that your system has Nix 2.4+ installed on it.
17 -* make sure that ssh-agent is running and that the bastion key is loaded in it.
bastion/bastion.tf deleted
-158
@@ -1,158 +0,0 @@
1 -locals {
2 - region = "eu-west-1"
3 - zone = "eu-west-1a"
4 -}
5 -
6 -resource "aws_vpc" "bastion" {
7 - cidr_block = "10.0.0.0/16"
8 - enable_dns_hostnames = true
9 - enable_dns_support = true
10 - instance_tenancy = "default"
11 -
12 - tags = {
13 - "CharonMachineName" = "bastion-vpc"
14 - "CharonNetworkName" = "nixos-bastion"
15 - "CharonNetworkUUID" = "d48ef0d9-7bb1-11e8-8c41-507b9defcdfc"
16 - "CharonStateFile" = "deploy@bastion:/home/deploy/.nixops/deployments.nixops"
17 - "Name" = "Unnamed NixOps network [bastion-vpc]"
18 - }
19 -}
20 -
21 -resource "aws_subnet" "bastion" {
22 - vpc_id = aws_vpc.bastion.id
23 - cidr_block = "10.0.0.0/19"
24 - map_public_ip_on_launch = true
25 -
26 - tags = {
27 - "CharonMachineName" = "bastion-subnet"
28 - "CharonNetworkName" = "nixos-bastion"
29 - "CharonNetworkUUID" = "d48ef0d9-7bb1-11e8-8c41-507b9defcdfc"
30 - "CharonStateFile" = "deploy@bastion:/home/deploy/.nixops/deployments.nixops"
31 - "Name" = "Unnamed NixOps network [bastion-subnet]"
32 - }
33 -}
34 -
35 -resource "aws_route_table" "bastion" {
36 - vpc_id = aws_vpc.bastion.id
37 - route = []
38 -}
39 -
40 -resource "aws_internet_gateway" "bastion" {
41 - vpc_id = aws_vpc.bastion.id
42 -
43 - tags = {
44 - "CharonMachineName" = "bastion-igw"
45 - "CharonNetworkName" = "nixos-bastion"
46 - "CharonNetworkUUID" = "d48ef0d9-7bb1-11e8-8c41-507b9defcdfc"
47 - "CharonStateFile" = "deploy@bastion:/home/deploy/.nixops/deployments.nixops"
48 - }
49 -}
50 -
51 -resource "aws_security_group" "bastion" {
52 - name = "charon-d48ef0d9-7bb1-11e8-8c41-507b9defcdfc-bastion-sg"
53 - description = "NixOps-provisioned group bastion-sg"
54 - vpc_id = aws_vpc.bastion.id
55 -
56 - egress = [
57 - {
58 - cidr_blocks = ["0.0.0.0/0"]
59 - description = ""
60 - from_port = 0
61 - ipv6_cidr_blocks = []
62 - prefix_list_ids = []
63 - protocol = "-1"
64 - security_groups = []
65 - self = false
66 - to_port = 0
67 - },
68 - ]
69 -
70 - ingress = [
71 - {
72 - cidr_blocks = ["0.0.0.0/0"]
73 - description = ""
74 - from_port = 51820
75 - ipv6_cidr_blocks = []
76 - prefix_list_ids = []
77 - protocol = "udp"
78 - security_groups = []
79 - self = false
80 - to_port = 51820
81 - },
82 - ]
83 -
84 - timeouts {}
85 -
86 - lifecycle {
87 - # User IPs are manually added to the security group.
88 - ignore_changes = [ingress]
89 - }
90 -}
91 -
92 -resource "aws_instance" "bastion" {
93 - ami = "ami-cda4fab4"
94 - instance_type = "t3.xlarge"
95 - subnet_id = aws_subnet.bastion.id
96 - disable_api_termination = true
97 -
98 - # TODO(zimbatm): move that to a aws_ebs_volume + aws_volume_attachment
99 - ebs_block_device {
100 - delete_on_termination = false
101 - device_name = "/dev/sdh"
102 - tags = {
103 - "CharonMachineName" = "scratch"
104 - "CharonNetworkName" = "nixos-bastion"
105 - "CharonNetworkUUID" = "d48ef0d9-7bb1-11e8-8c41-507b9defcdfc"
106 - "CharonStateFile" = "deploy@bastion:/home/deploy/.nixops/deployments.nixops"
107 - "Name" = "Scratch space for the channel generator"
108 - }
109 - volume_size = 64
110 - volume_type = "standard"
111 - }
112 -
113 - root_block_device {
114 - delete_on_termination = false
115 - iops = 450
116 - tags = {
117 - "Name" = "Unnamed NixOps network [bastion - /dev/xvda1]"
118 - "Owners" = "edolstra@gmail.com, rob.vermaas@gmail.com"
119 - }
120 - volume_size = 150
121 - volume_type = "gp2"
122 - }
123 -
124 - tags = {
125 - "CharonMachineName" = "bastion"
126 - "CharonNetworkName" = "nixos-bastion"
127 - "CharonNetworkUUID" = "d48ef0d9-7bb1-11e8-8c41-507b9defcdfc"
128 - "CharonStateFile" = "deploy@bastion:/home/deploy/.nixops/deployments.nixops"
129 - "Name" = "NixOS.org Infrastructure Deployment Server"
130 - "Owners" = "edolstra@gmail.com, rob.vermaas@gmail.com"
131 - }
132 -
133 - lifecycle {
134 - # FIXME(zimbatm): I'm not sure why, the user_data changes on every plan.
135 - ignore_changes = [user_data]
136 - }
137 -}
138 -
139 -resource "aws_eip" "bastion" {
140 - instance = aws_instance.bastion.id
141 - vpc = true
142 -}
143 -
144 -module "bastion_deploy" {
145 - source = "github.com/numtide/terraform-deploy-nixos-flakes"
146 -
147 - target_host = aws_eip.bastion.public_ip
148 - target_user = "deploy"
149 -
150 - flake = path.module
151 - flake_host = "bastion"
152 -
153 - ssh_agent = true
154 -
155 - triggers = {
156 - machine_id = aws_instance.bastion.id
157 - }
158 -}
bastion/configuration.nix deleted
-79
@@ -1,79 +0,0 @@
1 -flakes @ { self, nixpkgs, nix, nixops, nixos-channel-scripts }:
2 -
3 -{ modulesPath, config, lib, pkgs, ... }:
4 -let
5 - sshKeys = import ../ssh-keys.nix;
6 -in
7 -{
8 - imports = [
9 - ../modules/common.nix
10 - ../modules/prometheus
11 - ../modules/wireguard.nix
12 - "${modulesPath}/virtualisation/amazon-image.nix"
13 - ];
14 -
15 - ec2.hvm = true;
16 -
17 - networking.hostName = "bastion";
18 -
19 - system.stateVersion = "18.03";
20 -
21 - #system.configurationRevision = flakes.self.rev
22 - # or (throw "Cannot deploy from an unclean source tree!");
23 -
24 - nix.registry.nixpkgs.flake = flakes.nixpkgs;
25 - nix.nixPath = [ "nixpkgs=${flakes.nixpkgs}" ];
26 - nix.trustedUsers = [ "deploy" ];
27 -
28 - nixpkgs.overlays = [
29 - nix.overlays.default
30 - nixos-channel-scripts.overlays.default
31 - ];
32 -
33 - # Needed for nixops.
34 - nixpkgs.config.permittedInsecurePackages = [
35 - "python2.7-urllib3-1.26.2"
36 - ];
37 -
38 - users.extraUsers.deploy = {
39 - description = "NixOps deployments";
40 - isNormalUser = true;
41 - openssh.authorizedKeys.keys = sshKeys.infra-core;
42 - extraGroups = [ "wheel" ];
43 - };
44 -
45 - security.sudo.wheelNeedsPassword = false;
46 -
47 - environment.systemPackages = [
48 - pkgs.awscli
49 - nixops.defaultPackage.x86_64-linux
50 - pkgs.terraform.full
51 - pkgs.tmux
52 - ];
53 -
54 - nix.gc.automatic = true;
55 - nix.gc.dates = "daily";
56 - nix.gc.options = ''--max-freed "$((30 * 1024**3 - 1024 * $(df -P -k /nix/store | tail -n 1 | ${pkgs.gawk}/bin/awk '{ print $4 }')))"'';
57 -
58 - services.openssh.enable = true;
59 -
60 - # Temporary hack until we have proper users/roles.
61 - services.openssh.extraConfig = ''
62 - AcceptEnv AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY FASTLY_API_KEY GIT_AUTHOR_NAME GIT_AUTHOR_EMAIL GIT_COMMITTER_NAME GIT_COMMITTER_EMAIL
63 - '';
64 -
65 - fileSystems."/scratch" = {
66 - autoFormat = true;
67 - fsType = "ext4";
68 - device = "/dev/nvme1n1";
69 - };
70 -
71 - # work around releases taking too much memory
72 - swapDevices = [{ device = "/scratch/swapfile"; size = 32 * 1024; }];
73 - zramSwap.enable = true;
74 -
75 - # Enable swap so mirroring the channels doesn't make AWS think this machine is dead
76 - boot.kernel.sysctl."vm.swappiness" = lib.mkDefault 60;
77 -
78 - boot.loader.grub.device = lib.mkForce "/dev/disk/by-id/nvme-Amazon_Elastic_Block_Store_vol0631f5232321abda4";
79 -}
bastion/deploy.sh deleted
-9
@@ -1,9 +0,0 @@
1 -#!/usr/bin/env bash
2 -#
3 -# Temporary deploy script to work around NixOps.
4 -#
5 -nixos-rebuild \
6 - --flake ".#bastion" \
7 - --target-host bastion.nixos.org \
8 - --use-remote-sudo \
9 - "$@"
bastion/flake.lock deleted
-189
@@ -1,189 +0,0 @@
1 -{
2 - "nodes": {
3 - "flake-compat": {
4 - "flake": false,
5 - "locked": {
6 - "lastModified": 1673956053,
7 - "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
8 - "owner": "edolstra",
9 - "repo": "flake-compat",
10 - "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
11 - "type": "github"
12 - },
13 - "original": {
14 - "owner": "edolstra",
15 - "repo": "flake-compat",
16 - "type": "github"
17 - }
18 - },
19 - "lowdown-src": {
20 - "flake": false,
21 - "locked": {
22 - "lastModified": 1633514407,
23 - "narHash": "sha256-Dw32tiMjdK9t3ETl5fzGrutQTzh2rufgZV4A/BbxuD4=",
24 - "owner": "kristapsdz",
25 - "repo": "lowdown",
26 - "rev": "d2c2b44ff6c27b936ec27358a2653caaef8f73b8",
27 - "type": "github"
28 - },
29 - "original": {
30 - "owner": "kristapsdz",
31 - "repo": "lowdown",
32 - "type": "github"
33 - }
34 - },
35 - "nix": {
36 - "inputs": {
37 - "flake-compat": "flake-compat",
38 - "lowdown-src": "lowdown-src",
39 - "nixpkgs": [
40 - "nixpkgs"
41 - ],
42 - "nixpkgs-regression": "nixpkgs-regression"
43 - },
44 - "locked": {
45 - "lastModified": 1692622680,
46 - "narHash": "sha256-n5+foqRKUNbQg2ofGHe28BlGidem+iJea1gEyt9PTh0=",
47 - "owner": "NixOS",
48 - "repo": "nix",
49 - "rev": "3fcdea4ca0f362d21637002918b49cd41358e8e2",
50 - "type": "github"
51 - },
52 - "original": {
53 - "id": "nix",
54 - "type": "indirect"
55 - }
56 - },
57 - "nixops": {
58 - "inputs": {
59 - "nixops-aws": "nixops-aws",
60 - "nixops-hetzner": "nixops-hetzner",
61 - "nixpkgs": "nixpkgs"
62 - },
63 - "locked": {
64 - "lastModified": 1662643698,
65 - "narHash": "sha256-VhAhUUIuf98h6DGBtA3cYV133iO/gqkc0DTXXGLTW4s=",
66 - "owner": "NixOS",
67 - "repo": "nixops",
68 - "rev": "065625ac5f7f0660cdd3e5471291b5f6556a284c",
69 - "type": "github"
70 - },
71 - "original": {
72 - "owner": "NixOS",
73 - "ref": "flake-support",
74 - "repo": "nixops",
75 - "type": "github"
76 - }
77 - },
78 - "nixops-aws": {
79 - "flake": false,
80 - "locked": {
81 - "lastModified": 1586700941,
82 - "narHash": "sha256-9yh7iHMJ8F8wA4nwTjm8rcmceFM/6URHK/Q/AuCkdzE=",
83 - "owner": "NixOS",
84 - "repo": "nixops-aws",
85 - "rev": "af97c16f179cd0df94a6fc3ef470092122253f60",
86 - "type": "github"
87 - },
88 - "original": {
89 - "owner": "NixOS",
90 - "ref": "flake",
91 - "repo": "nixops-aws",
92 - "type": "github"
93 - }
94 - },
95 - "nixops-hetzner": {
96 - "flake": false,
97 - "locked": {
98 - "lastModified": 1586701048,
99 - "narHash": "sha256-q1QhsSp3N4nffnpUnGrF0Jg7VyLvi9JXiD82oxaM/Jg=",
100 - "owner": "NixOS",
101 - "repo": "nixops-hetzner",
102 - "rev": "663b02618ece7a92a72da408a552528ee8dd354c",
103 - "type": "github"
104 - },
105 - "original": {
106 - "owner": "NixOS",
107 - "ref": "zfs",
108 - "repo": "nixops-hetzner",
109 - "type": "github"
110 - }
111 - },
112 - "nixos-channel-scripts": {
113 - "inputs": {
114 - "nixpkgs": [
115 - "nixpkgs"
116 - ]
117 - },
118 - "locked": {
119 - "lastModified": 1706467232,
120 - "narHash": "sha256-RCad+aar+l6amAjNGCF0wcAqSi45NqVc8PUT2KPXIUg=",
121 - "owner": "NixOS",
122 - "repo": "nixos-channel-scripts",
123 - "rev": "919045560c98f846f0b94d4896ba8e2356e7fd39",
124 - "type": "github"
125 - },
126 - "original": {
127 - "owner": "NixOS",
128 - "repo": "nixos-channel-scripts",
129 - "type": "github"
130 - }
131 - },
132 - "nixpkgs": {
133 - "locked": {
134 - "lastModified": 1586219474,
135 - "narHash": "sha256-fvfrMnEA2lDnXvH/eInGV5i0sO/EGLVHa4pOek8VG78=",
136 - "owner": "NixOS",
137 - "repo": "nixpkgs",
138 - "rev": "29eddfc36d720dcc4822581175217543b387b1e8",
139 - "type": "github"
140 - },
141 - "original": {
142 - "id": "nixpkgs",
143 - "ref": "nixos-20.03",
144 - "type": "indirect"
145 - }
146 - },
147 - "nixpkgs-regression": {
148 - "locked": {
149 - "lastModified": 1643052045,
150 - "narHash": "sha256-uGJ0VXIhWKGXxkeNnq4TvV3CIOkUJ3PAoLZ3HMzNVMw=",
151 - "owner": "NixOS",
152 - "repo": "nixpkgs",
153 - "rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2",
154 - "type": "github"
155 - },
156 - "original": {
157 - "owner": "NixOS",
158 - "repo": "nixpkgs",
159 - "rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2",
160 - "type": "github"
161 - }
162 - },
163 - "nixpkgs_2": {
164 - "locked": {
165 - "lastModified": 1692525914,
166 - "narHash": "sha256-MUgZ9/9mE/EbEQA6JPdcQHkjoR5fgvaKhpy6UO67uEc=",
167 - "owner": "NixOS",
168 - "repo": "nixpkgs",
169 - "rev": "475d5ae2c4cb87b904545bdb547af05681198fcc",
170 - "type": "github"
171 - },
172 - "original": {
173 - "id": "nixpkgs",
174 - "ref": "nixos-23.05",
175 - "type": "indirect"
176 - }
177 - },
178 - "root": {
179 - "inputs": {
180 - "nix": "nix",
181 - "nixops": "nixops",
182 - "nixos-channel-scripts": "nixos-channel-scripts",
183 - "nixpkgs": "nixpkgs_2"
184 - }
185 - }
186 - },
187 - "root": "root",
188 - "version": 7
189 -}
bastion/flake.nix deleted
-27
@@ -1,27 +0,0 @@
1 -{
2 - inputs.nixpkgs.url = "nixpkgs/nixos-23.05";
3 - inputs.nixops.url = "github:NixOS/nixops/flake-support";
4 - inputs.nixos-channel-scripts.url = "github:NixOS/nixos-channel-scripts";
5 - inputs.nixos-channel-scripts.inputs.nixpkgs.follows = "nixpkgs";
6 - inputs.nix.inputs.nixpkgs.follows = "nixpkgs";
7 -
8 - outputs = flakes @ { self, nixpkgs, nix, nixops, nixos-channel-scripts }: {
9 - nixosConfigurations.bastion = nixpkgs.lib.nixosSystem {
10 - system = "x86_64-linux";
11 - modules = [ (import ./configuration.nix flakes) ];
12 - };
13 -
14 - devShell.x86_64-linux =
15 - with nixpkgs.legacyPackages.x86_64-linux;
16 - mkShell {
17 - nativeBuildInputs = [
18 - awscli
19 - (terraform.withPlugins (p: with p; [ aws p.null external ]))
20 - ];
21 -
22 - shellHook = ''
23 - alias tf=terraform
24 - '';
25 - };
26 - };
27 -}
bastion/terraform.tf deleted
-18
@@ -1,18 +0,0 @@
1 -terraform {
2 - backend "s3" {
3 - bucket = "nixos-terraform-state"
4 - encrypt = true
5 - key = "targets/bastion"
6 - region = "eu-west-1"
7 - }
8 -
9 - required_providers {
10 - aws = {
11 - source = "hashicorp/aws"
12 - }
13 - }
14 -}
15 -
16 -provider "aws" {
17 - region = "eu-west-1"
18 -}
delft/pluto/prometheus/default.nix
-1
@@ -23,7 +23,6 @@
23 ];
24
25 networking.extraHosts = ''
26 - 10.254.1.1 bastion
26 10.254.1.5 rhea
27 10.254.1.6 pluto
28
delft/pluto/prometheus/exporters/nixos.nix
-5
@@ -16,11 +16,6 @@
16 targets = [
17 "haumea:9300"
18 ];
19 - } {
20 - labels.role = "bastion";
21 - targets = [
22 - "bastion:9300"
23 - ];
19 } ];
20 } ];
21 }
delft/pluto/prometheus/exporters/node.nix
-5
@@ -21,11 +21,6 @@
21 targets = [
22 "pluto:9100"
23 ];
24 - } {
25 - labels.role = "bastion";
26 - targets = [
27 - "bastion:9100"
28 - ];
24 } {
25 labels.role = "mac";
26 targets = [
docs/client-setup.md deleted
-20
@@ -1,20 +0,0 @@
1 -# Client setup
2 -
3 -This document contains the machine setup of the infrastructure member.
4 -
5 -## Dependencies
6 -
7 -Install Nix obviously :)
8 -
9 -## SSH configuration
10 -
11 -Add the following to the `~/.ssh/config` file:
12 -
13 -```
14 -Host bastion.nixos.org
15 - User deploy
16 - SendEnv FASTLY_API_KEY AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
17 - SetEnv GIT_AUTHOR_NAME="Your Name" GIT_COMMITTER_NAME="Your Name" GIT_AUTHOR_EMAIL="your.name@example.com" GIT_COMMITTER_EMAIL="your.name@example.com"
18 - ForwardAgent yes
19 - IdentityFile ~/.ssh/nixos_rsa
20 -```
docs/inventory.md
+1 -10
@@ -144,7 +144,7 @@ owner: Graham
144
145 owner: Eelco and Rob, owned by the NixOS Foundation
146
147 -“chef”: runs hydra.nixos.org, postgresql database, queue runner, hydra provisioner (might move to the bastion). binary cache signing keys.
147 +“chef”: runs hydra.nixos.org, postgresql database, queue runner, hydra provisioner. binary cache signing keys.
148
149 monitoring:
150 **DataDog, accessible by Eelco (and Rob?) (Amine?) on the Infor account**
@@ -178,12 +178,3 @@ runs the website
178 runs the channel mirror script, systemd services with timers, updates /releases buckets and the nixpkgs-channels repository (repo: nixos-channel-scripts)
179
180 The tarball mirror script is running from that machine.
181 -
182 -## bastion server
183 -
184 -owner: LogicBlox EC2 instance
185 -
186 -running in the lb-nixos AWS account
187 -
188 -going to be used to apply NixOps
189 -
modules/wireguard-hosts.toml
+1 -10
@@ -8,16 +8,7 @@ network = 16
8 # 50 - 60: x86 mac minis reserved for ofborg
9 # 100 - 110: m1 mac minis running macOS on the hardware
10 # 10.254.3.x: (defunct) NixOS.org hosting infrastructure
11 -# 10.254.4.x: infra team administrator machines, for connecting to the bastion
12 -
13 -[hosts.bastion]
14 -# wg won't retry resolution if it fails... so
15 -# hard-code the IP to bastion.nixos.org so we don't lock
16 -# ourselves out.
17 -endpoint = "34.254.208.229"
18 -ip = "10.254.1.1"
19 -port = 51820
20 -publicKey = "nG7I9gegJIynKOZ6tzpvmLdCZ/xScTgRZeFvYLFyil4="
11 +# 10.254.4.x: infra team administrator machines
12
13 # tombstone: 10.254.1.2 chef
14 # tomstone: 10.254.1.3 ceres
terraform/dns.tf
-5
@@ -11,11 +11,6 @@ locals {
11 zone_id = netlify_dns_zone.nixos.id
12
13 dns_records = [
14 - {
15 - hostname = "bastion.nixos.org"
16 - type = "A"
17 - value = "34.254.208.229"
18 - },
14 {
15 hostname = "eris.nixos.org"
16 type = "A"