Compare commits

...

3 Commits

Author SHA1 Message Date
github-actions[bot]
bb23e9fdbe flake.lock: Update
Flake lock file updates:

• Updated input 'disko':
    'github:nix-community/disko/79eab0e82cb126bf4ac170f44af82479f0895ab5' (2024-04-08)
  → 'github:nix-community/disko/8d4ae698eaac8bd717e23507da2ca8b345bec4b5' (2024-04-12)
• Updated input 'firefox-darwin':
    'github:bandithedoge/nixpkgs-firefox-darwin/49b3ee7dbb9fdbb6388bd5d47895a9a9992b771e' (2024-04-09)
  → 'github:bandithedoge/nixpkgs-firefox-darwin/10e4a50241d6bbae62754efda7bc4b48dd4aa2c1' (2024-04-14)
• Updated input 'home-manager':
    'github:nix-community/home-manager/b00d0e4fe9cba0047f54e77418ddda5f17e6ef2c' (2024-04-09)
  → 'github:nix-community/home-manager/630a0992b3627c64e34f179fab68e3d48c6991c0' (2024-04-14)
• Updated input 'nextcloud-snappymail':
    'https://snappymail.eu/repository/nextcloud/snappymail-2.32.0-nextcloud.tar.gz?narHash=sha256-UeZXoZFEPJj7zEVNTXJ3IYNt/wI7VFq3Pjh1ubMHCBo%3D' (2024-04-09)
  → 'https://snappymail.eu/repository/nextcloud/snappymail-2.32.0-nextcloud.tar.gz?narHash=sha256-UeZXoZFEPJj7zEVNTXJ3IYNt/wI7VFq3Pjh1ubMHCBo%3D' (2024-04-14)
• Updated input 'nur':
    'github:nix-community/nur/ee4ce451f46a08778d1a9f9837eff0750714b08b' (2024-04-09)
  → 'github:nix-community/nur/1e6e9f41f0fbdcba7ca505a7d54128bc2f1053d6' (2024-04-14)
• Updated input 'nvim-treesitter-src':
    'github:nvim-treesitter/nvim-treesitter/c16f66cca0c38b4e21371d8330b7f2ad6404f6dc' (2024-04-09)
  → 'github:nvim-treesitter/nvim-treesitter/d2f4c7830377d6d036e9621ae696dbd28f089897' (2024-04-14)
• Updated input 'tree-sitter-bash':
    'github:tree-sitter/tree-sitter-bash/f3f26f47a126797c011c311cec9d449d855c3eab' (2024-03-13)
  → 'github:tree-sitter/tree-sitter-bash/f8fb3274f72a30896075585b32b0c54cad65c086' (2024-04-11)
• Updated input 'wsl':
    'github:nix-community/NixOS-WSL/aef95bdb6800a3a2af7aa7083d6df03067da6592' (2024-03-15)
  → 'github:nix-community/NixOS-WSL/0479d4c1ebeb314c5281b4aa7109def821a1b27b' (2024-04-13)
• Updated input 'wsl/flake-utils':
    'github:numtide/flake-utils/1ef2e671c3b0c19053962c07dbda38332dcebf26' (2024-01-15)
  → 'github:numtide/flake-utils/b1d9ab70662946ef0850d488da1c9019f3a9752a' (2024-03-11)
2024-04-14 12:32:23 +00:00
Noah Masur
358206f6fb
arrow image package derivation 2024-04-14 08:28:39 -04:00
Noah Masur
402d168304
remove aws and clean up arrow 2024-04-14 08:08:57 -04:00
12 changed files with 172 additions and 458 deletions

View File

@ -3,7 +3,7 @@ name: Arrow
run-name: Arrow - ${{ inputs.rebuild && 'Rebuild and ' || '' }}${{ inputs.action == 'create' && 'Create' || ( inputs.action == 'destroy' && 'Destroy' || 'No Action' ) }}
env:
TERRAFORM_DIRECTORY: hosts/arrow
TERRAFORM_DIRECTORY: hosts/arrow/vultr
DEPLOY_IDENTITY_BASE64: ${{ secrets.DEPLOY_IDENTITY_BASE64 }}
ARROW_IDENTITY_BASE64: ${{ secrets.ARROW_IDENTITY_BASE64 }}
CLOUDFLARE_R2_ENDPOINT: "${{ secrets.CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com"
@ -65,7 +65,7 @@ jobs:
# Build the image
- name: Build Image
if: inputs.rebuild && inputs.action != 'destroy'
run: nix build .#image.arrow
run: nix build .#arrow
- name: Upload Image to S3
if: inputs.rebuild && inputs.action != 'destroy'

View File

@ -126,11 +126,11 @@
]
},
"locked": {
"lastModified": 1712612224,
"narHash": "sha256-Tv4C8OSPVmm4LbpJGLFSODyvJy6DqrisEGPCQdNVOeY=",
"lastModified": 1712947906,
"narHash": "sha256-T0eT2lMbcK7RLelkx0qx4SiFpOS/0dt0aSfLB+WsGV8=",
"owner": "nix-community",
"repo": "disko",
"rev": "79eab0e82cb126bf4ac170f44af82479f0895ab5",
"rev": "8d4ae698eaac8bd717e23507da2ca8b345bec4b5",
"type": "github"
},
"original": {
@ -163,11 +163,11 @@
]
},
"locked": {
"lastModified": 1712623312,
"narHash": "sha256-6NlzHMtxCdlF+Zq1Y10YnVr5M/AgMcVhEMZlxlQyeNo=",
"lastModified": 1713055748,
"narHash": "sha256-LlFkVfdF9GfB02gFNHjnLOV0AQYFY7gWATlniTALeaM=",
"owner": "bandithedoge",
"repo": "nixpkgs-firefox-darwin",
"rev": "49b3ee7dbb9fdbb6388bd5d47895a9a9992b771e",
"rev": "10e4a50241d6bbae62754efda7bc4b48dd4aa2c1",
"type": "github"
},
"original": {
@ -215,11 +215,11 @@
"systems": "systems_2"
},
"locked": {
"lastModified": 1705309234,
"narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
"lastModified": 1710146030,
"narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
"rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
"type": "github"
},
"original": {
@ -251,11 +251,11 @@
]
},
"locked": {
"lastModified": 1712688495,
"narHash": "sha256-NrVLXkpT9ZigiI8md6NIzHS+3lE4QTj30IgXG57O9iM=",
"lastModified": 1713077896,
"narHash": "sha256-Noot8H0EZEAFRQWyGxh9ryvhK96xpIqKbh78X447JWs=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "b00d0e4fe9cba0047f54e77418ddda5f17e6ef2c",
"rev": "630a0992b3627c64e34f179fab68e3d48c6991c0",
"type": "github"
},
"original": {
@ -323,7 +323,7 @@
"nextcloud-snappymail": {
"flake": false,
"locked": {
"lastModified": 1712695892,
"lastModified": 1713097756,
"narHash": "sha256-UeZXoZFEPJj7zEVNTXJ3IYNt/wI7VFq3Pjh1ubMHCBo=",
"type": "tarball",
"url": "https://snappymail.eu/repository/nextcloud/snappymail-2.32.0-nextcloud.tar.gz"
@ -408,11 +408,11 @@
},
"nur": {
"locked": {
"lastModified": 1712692796,
"narHash": "sha256-q3Tx4kS+nH4IDcEsZSv8o2IuCn475mGhCYBXxfxZ2gY=",
"lastModified": 1713093341,
"narHash": "sha256-zON2LEPO98NiUtOItgu+Vz1uWkrUbt5zJbzf5XCm71Y=",
"owner": "nix-community",
"repo": "nur",
"rev": "ee4ce451f46a08778d1a9f9837eff0750714b08b",
"rev": "1e6e9f41f0fbdcba7ca505a7d54128bc2f1053d6",
"type": "github"
},
"original": {
@ -473,11 +473,11 @@
"nvim-treesitter-src": {
"flake": false,
"locked": {
"lastModified": 1712690702,
"narHash": "sha256-iWP5nIswAs+7oNBhJpPzBqJ5BLXEt8+kHPi22RtAK3Q=",
"lastModified": 1713097426,
"narHash": "sha256-rtE1H24sKekGwTIMh7VXkwKVCbJtn8ms4ioK9gF+KxY=",
"owner": "nvim-treesitter",
"repo": "nvim-treesitter",
"rev": "c16f66cca0c38b4e21371d8330b7f2ad6404f6dc",
"rev": "d2f4c7830377d6d036e9621ae696dbd28f089897",
"type": "github"
},
"original": {
@ -660,11 +660,11 @@
"tree-sitter-bash": {
"flake": false,
"locked": {
"lastModified": 1710290046,
"narHash": "sha256-6Rfxh8Y6dg2wyQ9jYnbOaXm1SVfQDQ1B1tNqgpz6sY4=",
"lastModified": 1712878661,
"narHash": "sha256-sj1qYb42k0hXXcNCKg1hINYD11wDcVpnoPhZNtlYT6k=",
"owner": "tree-sitter",
"repo": "tree-sitter-bash",
"rev": "f3f26f47a126797c011c311cec9d449d855c3eab",
"rev": "f8fb3274f72a30896075585b32b0c54cad65c086",
"type": "github"
},
"original": {
@ -797,11 +797,11 @@
]
},
"locked": {
"lastModified": 1710519878,
"narHash": "sha256-0dbc10OBFUVYyXC+C+N6vRUd8xyBSRxkcZ4Egipbx0M=",
"lastModified": 1712984363,
"narHash": "sha256-VgCqYB+ymQuZmno8B82L8piyENo5xTNuqubnACYoBRk=",
"owner": "nix-community",
"repo": "NixOS-WSL",
"rev": "aef95bdb6800a3a2af7aa7083d6df03067da6592",
"rev": "0479d4c1ebeb314c5281b4aa7109def821a1b27b",
"type": "github"
},
"original": {

202
flake.nix
View File

@ -22,8 +22,7 @@
# Used for user packages and dotfiles
home-manager = {
url = "github:nix-community/home-manager/master";
inputs.nixpkgs.follows =
"nixpkgs"; # Use system packages list for their inputs
inputs.nixpkgs.follows = "nixpkgs"; # Use system packages list for their inputs
};
# Community packages; used for Firefox extensions
@ -179,78 +178,75 @@
# Alternatively, could consider using https://github.com/fufexan/nix-gaming
proton-ge = {
# https://github.com/GloriousEggroll/proton-ge-custom/releases
url =
"https://github.com/GloriousEggroll/proton-ge-custom/releases/download/GE-Proton9-2/GE-Proton9-2.tar.gz";
url = "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/GE-Proton9-2/GE-Proton9-2.tar.gz";
flake = false;
};
# Firefox addon from outside the extension store
bypass-paywalls-clean = {
# https://gitlab.com/magnolia1234/bpc-uploads/-/commits/master/?ref_type=HEADS
url =
"git+https://git.masu.rs/noah/bpc-uploads"; # temporary, shouldn't rely on myself
url = "git+https://git.masu.rs/noah/bpc-uploads"; # temporary, shouldn't rely on myself
flake = false;
};
# Nextcloud Apps
nextcloud-news = {
# https://github.com/nextcloud/news/releases
url =
"https://github.com/nextcloud/news/releases/download/25.0.0-alpha3/news.tar.gz";
url = "https://github.com/nextcloud/news/releases/download/25.0.0-alpha3/news.tar.gz";
flake = false;
};
nextcloud-external = {
# https://github.com/nextcloud-releases/external/releases
url =
"https://github.com/nextcloud-releases/external/releases/download/v5.3.1/external-v5.3.1.tar.gz";
url = "https://github.com/nextcloud-releases/external/releases/download/v5.3.1/external-v5.3.1.tar.gz";
flake = false;
};
nextcloud-cookbook = {
# https://github.com/christianlupus-nextcloud/cookbook-releases/releases/
url =
"https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.0/cookbook-0.11.0.tar.gz";
url = "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.0/cookbook-0.11.0.tar.gz";
flake = false;
};
nextcloud-snappymail = {
# https://github.com/the-djmaze/snappymail/releases
url =
"https://snappymail.eu/repository/nextcloud/snappymail-2.32.0-nextcloud.tar.gz";
url = "https://snappymail.eu/repository/nextcloud/snappymail-2.32.0-nextcloud.tar.gz";
flake = false;
};
};
outputs = { nixpkgs, ... }@inputs:
outputs =
{ nixpkgs, ... }@inputs:
let
# Global configuration for my systems
globals = let baseName = "masu.rs";
in rec {
user = "noah";
fullName = "Noah Masur";
gitName = fullName;
gitEmail = "7386960+nmasur@users.noreply.github.com";
mail.server = "noahmasur.com";
mail.imapHost = "imap.purelymail.com";
mail.smtpHost = "smtp.purelymail.com";
dotfilesRepo = "https://github.com/nmasur/dotfiles";
hostnames = {
git = "git.${baseName}";
influxdb = "influxdb.${baseName}";
irc = "irc.${baseName}";
metrics = "metrics.${baseName}";
minecraft = "minecraft.${baseName}";
prometheus = "prom.${baseName}";
paperless = "paper.${baseName}";
secrets = "vault.${baseName}";
stream = "stream.${baseName}";
content = "cloud.${baseName}";
books = "books.${baseName}";
download = "download.${baseName}";
transmission = "transmission.${baseName}";
globals =
let
baseName = "masu.rs";
in
rec {
user = "noah";
fullName = "Noah Masur";
gitName = fullName;
gitEmail = "7386960+nmasur@users.noreply.github.com";
mail.server = "noahmasur.com";
mail.imapHost = "imap.purelymail.com";
mail.smtpHost = "smtp.purelymail.com";
dotfilesRepo = "https://github.com/nmasur/dotfiles";
hostnames = {
git = "git.${baseName}";
influxdb = "influxdb.${baseName}";
irc = "irc.${baseName}";
metrics = "metrics.${baseName}";
minecraft = "minecraft.${baseName}";
prometheus = "prom.${baseName}";
paperless = "paper.${baseName}";
secrets = "vault.${baseName}";
stream = "stream.${baseName}";
content = "cloud.${baseName}";
books = "books.${baseName}";
download = "download.${baseName}";
transmission = "transmission.${baseName}";
};
};
};
# Common overlays to always use
overlays = [
@ -271,13 +267,17 @@
];
# System types to support.
supportedSystems =
[ "x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin" ];
supportedSystems = [
"x86_64-linux"
"x86_64-darwin"
"aarch64-linux"
"aarch64-darwin"
];
# Helper function to generate an attrset '{ x86_64-linux = f "x86_64-linux"; ... }'.
forAllSystems = nixpkgs.lib.genAttrs supportedSystems;
in rec {
in
rec {
# Contains my full system builds, including home-manager
# nixos-rebuild switch --flake .#tempest
@ -292,65 +292,84 @@
# Contains my full Mac system builds, including home-manager
# darwin-rebuild switch --flake .#lookingglass
darwinConfigurations = {
lookingglass =
import ./hosts/lookingglass { inherit inputs globals overlays; };
lookingglass = import ./hosts/lookingglass { inherit inputs globals overlays; };
};
# For quickly applying home-manager settings with:
# home-manager switch --flake .#tempest
homeConfigurations = {
tempest =
nixosConfigurations.tempest.config.home-manager.users.${globals.user}.home;
lookingglass =
darwinConfigurations.lookingglass.config.home-manager.users."Noah.Masur".home;
tempest = nixosConfigurations.tempest.config.home-manager.users.${globals.user}.home;
lookingglass = darwinConfigurations.lookingglass.config.home-manager.users."Noah.Masur".home;
};
# Disk formatting, only used once
diskoConfigurations = { root = import ./disks/root.nix; };
packages = let
arrow = system:
import ./hosts/arrow { inherit inputs globals overlays system; };
aws = system:
import ./hosts/aws { inherit inputs globals overlays system; };
staff = system:
import ./hosts/staff { inherit inputs globals overlays system; };
neovim = system:
let pkgs = import nixpkgs { inherit system overlays; };
in import ./modules/common/neovim/package {
inherit pkgs;
colors = (import ./colorscheme/gruvbox-dark).dark;
};
in {
x86_64-linux.arrow = arrow "x86_64-linux";
x86_64-linux.aws = aws "x86_64-linux";
x86_64-linux.staff = staff "x86_64-linux";
x86_64-linux.image = {
arrow = inputs.nixos-generators.nixosGenerate {
system = "x86_64-linux";
format = "iso";
modules = import ./hosts/arrow/modules.nix {
inherit inputs globals overlays;
};
};
};
# Package Neovim config into standalone package
x86_64-linux.neovim = neovim "x86_64-linux";
x86_64-darwin.neovim = neovim "x86_64-darwin";
aarch64-linux.neovim = neovim "aarch64-linux";
aarch64-darwin.neovim = neovim "aarch64-darwin";
diskoConfigurations = {
root = import ./disks/root.nix;
};
packages =
let
arrow =
system:
import ./hosts/arrow {
inherit
inputs
globals
overlays
system
;
};
staff =
system:
import ./hosts/staff {
inherit
inputs
globals
overlays
system
;
};
neovim =
system:
let
pkgs = import nixpkgs { inherit system overlays; };
in
import ./modules/common/neovim/package {
inherit pkgs;
colors = (import ./colorscheme/gruvbox-dark).dark;
};
in
{
x86_64-linux.staff = staff "x86_64-linux";
x86_64-linux.arrow = inputs.nixos-generators.nixosGenerate {
system = "x86_64-linux";
format = "iso";
modules = import ./hosts/arrow/modules.nix { inherit inputs globals overlays; };
};
# Package Neovim config into standalone package
x86_64-linux.neovim = neovim "x86_64-linux";
x86_64-darwin.neovim = neovim "x86_64-darwin";
aarch64-linux.neovim = neovim "aarch64-linux";
aarch64-darwin.neovim = neovim "aarch64-darwin";
};
# Programs that can be run by calling this flake
apps = forAllSystems (system:
let pkgs = import nixpkgs { inherit system overlays; };
in import ./apps { inherit pkgs; });
apps = forAllSystems (
system:
let
pkgs = import nixpkgs { inherit system overlays; };
in
import ./apps { inherit pkgs; }
);
# Development environments
devShells = forAllSystems (system:
let pkgs = import nixpkgs { inherit system overlays; };
in {
devShells = forAllSystems (
system:
let
pkgs = import nixpkgs { inherit system overlays; };
in
{
# Used to run commands and edit files in this repo
default = pkgs.mkShell {
@ -419,6 +438,5 @@
description = "Rust template";
};
};
};
}

View File

@ -26,7 +26,7 @@ data "aws_iam_policy_document" "vmimport" {
actions = [
"s3:GetBucketLocation",
"s3:GetObject",
"s3:ListBucket",
"s3:ListBucket",
]
resources = [
"arn:aws:s3:::${aws_s3_object.image.bucket}",

View File

@ -1,3 +1,6 @@
# The Arrow
# System configuration for temporary VM
{
inputs,
globals,

View File

@ -1,41 +0,0 @@
{
inputs,
system,
globals,
overlays,
...
}:
inputs.nixos-generators.nixosGenerate {
inherit system;
format = "amazon";
modules =
[
globals
inputs.home-manager.nixosModules.home-manager
{
nixpkgs.overlays = overlays;
networking.hostName = "sheep";
gui.enable = false;
theme.colors = (import ../../colorscheme/gruvbox).dark;
passwordHash = null;
publicKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s personal"
];
# AWS settings require this
permitRootLogin = "prohibit-password";
}
../../modules/common
../../modules/nixos
../../modules/nixos/services/sshd.nix
]
++ [
# Required to fix diskSize errors during build
(
{ ... }:
{
amazonImage.sizeMB = 16 * 1024;
}
)
];
}

View File

@ -1,280 +0,0 @@
name: 'Terraform'
env:
AWS_ACCOUNT_NUMBER: ''
AWS_PLAN_ROLE_NAME: github_actions_plan
AWS_APPLY_ROLE_NAME: github_actions_admin
# Always required. Used for authenticating to AWS, but can also act as your
# default region if you don't want to specify in the provider configuration.
AWS_REGION: us-east-1
# You must change these to fit your project.
TF_VAR_project: change-me
TF_VAR_label: change-me
TF_VAR_owner: Your Name Here
# If storing Terraform in a subdirectory, specify it here.
TERRAFORM_DIRECTORY: .
# Pinned versions of tools to use.
# Check for new releases:
# - https://github.com/hashicorp/terraform/releases
# - https://github.com/fugue/regula/releases
# - https://github.com/terraform-linters/tflint/releases
TERRAFORM_VERSION: 1.2.6
REGULA_VERSION: 2.9.0
TFLINT_VERSION: 0.39.1
# Terraform configuration options
TERRAFORM_PARALLELISM: 10
# These variables are passed to Terraform based on GitHub information.
TF_VAR_repo: ${{ github.repository }}
# This workflow is triggered in the following ways.
on:
# Any push or merge to these branches.
push:
branches:
- dev
- prod
# Any pull request targeting these branches (plan only).
pull_request:
branches:
- dev
- prod
# Any manual trigger on these branches.
workflow_dispatch:
branches:
- dev
- prod
# -------------------------------------------------------------------
# The rest of this workflow can operate without adjustments. Edit the
# below content at your own risk!
# -------------------------------------------------------------------
# Used to connect to AWS IAM
permissions:
id-token: write
contents: read
pull-requests: write
# Only run one workflow at a time for each Terraform state. This prevents
# lockfile conflicts, especially during PR vs push.
concurrency: terraform-${{ github.base_ref || github.ref }}
jobs:
terraform:
name: 'Terraform'
# Change this if you need to run your deployment on-prem.
runs-on: ubuntu-latest
steps:
# Downloads the current repo code to the runner.
- name: Checkout Repo Code
uses: actions/checkout@v3
# Enable access to KVM, required to build an image
- name: Enable KVM group perms
run: |
echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
sudo udevadm control --reload-rules
sudo udevadm trigger --name-match=kvm
# Login to AWS
- name: AWS Assume Role
uses: aws-actions/configure-aws-credentials@v1.6.1
with:
role-to-assume: ${{ env.AWS_ROLE_ARN }}
aws-region: ${{ env.AWS_REGION }}
# Install Nix
- name: Install Nix
uses: cachix/install-nix-action@v17
with:
extra_nix_config: |
substituters = s3://insert-cache-bucket https://cache.nixos.org/
trusted-public-keys = insert-cache-bucket:M6PsZjHXcLvbQyPUBLICKEYGVoNwI84g1FBQzouRU= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
# Build the image
- name: Build Image
run: nix build .#aws
# Copy the image to S3
- name: Upload Image to Cache
env:
NIX_CACHE_PRIVATE_KEY: ${{ secrets.NIX_CACHE_PRIVATE_KEY }}
run: |
echo "$NIX_CACHE_PRIVATE_KEY" > cache.key
nix store sign --key-file cache.key $(readlink result)
nix copy --to s3://t2-aws-nixos-test $(readlink result)
rm cache.key
# Exports all GitHub Secrets as environment variables prefixed by
# "TF_VAR_", which exposes them to Terraform. The name of each GitHub
# Secret must match its Terraform variable name exactly.
- name: Export Secrets to Terraform Variables
env:
ALL_SECRETS: ${{ toJson(secrets) }}
run: |
echo "$ALL_SECRETS" \
| jq "to_entries | .[] | \"TF_VAR_\" + ( .key | ascii_downcase ) + \"=\" + .value" \
| tr -d \" >> $GITHUB_ENV
# Installs the Terraform binary and some other accessory functions.
- name: Setup Terraform
uses: hashicorp/setup-terraform@v2
with:
terraform_version: ${{ env.TERRAFORM_VERSION }}
# Checks whether Terraform is formatted properly. If this fails, you
# should install the pre-commit hook.
- name: Check Formatting
run: |
terraform fmt -no-color -check -diff -recursive
# Downloads a Terraform code lint test.
- uses: terraform-linters/setup-tflint@v1
name: Setup TFLint
with:
tflint_version: v${{ env.TFLINT_VERSION }}
# Sets up linting with this codebase.
- name: Init TFLint
working-directory: ${{ env.TERRAFORM_DIRECTORY }}
run: tflint --init
# Lints the current code.
- name: Run TFLint
working-directory: ${{ env.TERRAFORM_DIRECTORY }}
run: |
tflint -f compact
find ./modules/* -type d -maxdepth 0 | xargs -I __ tflint -f compact --disable-rule=terraform_required_providers --disable-rule=terraform_required_version __
# Connects to remote state backend and download providers.
- name: Terraform Init
working-directory: ${{ env.TERRAFORM_DIRECTORY }}
run: |
terraform init \
-backend-config="role_arn=${{ env.AWS_STATE_ROLE_ARN }}" \
-backend-config="region=us-east-1" \
-backend-config="workspace_key_prefix=accounts/${{ env.AWS_ACCOUNT_NUMBER }}/${{ github.repository }}" \
-backend-config="key=state.tfstate" \
-backend-config="dynamodb_table=global-tf-state-lock"
# Set the Terraform Workspace to the current branch name.
- name: Set Terraform Workspace
working-directory: ${{ env.TERRAFORM_DIRECTORY }}
shell: bash
run: |
export WORKSPACE=${{ github.base_ref || github.ref_name }}
terraform workspace select ${WORKSPACE} || terraform workspace new $WORKSPACE
echo "TF_WORKSPACE=$(echo ${WORKSPACE} | sed 's/\//_/g')" >> $GITHUB_ENV
# Checks differences between current code and infrastructure state.
- name: Terraform Plan
id: plan
working-directory: ${{ env.TERRAFORM_DIRECTORY }}
run: |
terraform plan \
-input=false \
-no-color \
-out=tfplan \
-parallelism=${TERRAFORM_PARALLELISM} \
-var-file=variables-${TF_WORKSPACE}.tfvars
# Gets the results of the plan for pull requests.
- name: Terraform Show Plan
id: show
working-directory: ${{ env.TERRAFORM_DIRECTORY }}
run: terraform show -no-color tfplan
# Adds the results of the plan to the pull request.
- name: Comment Plan
uses: actions/github-script@v6
if: github.event_name == 'pull_request'
env:
STDOUT: "```terraform\n${{ steps.show.outputs.stdout }}```"
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
// 1. Retrieve existing bot comments for the PR
const { data: comments } = await github.rest.issues.listComments({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: context.issue.number,
})
const botComment = comments.find(comment => {
return comment.user.type === 'Bot' && comment.body.includes('Terraform Format and Style')
})
// 2. Prepare format of the comment
const output = `#### Terraform Format and Style 🖌\`${{ steps.fmt.outcome }}\`
#### Terraform Initialization ⚙️\`${{ steps.init.outcome }}\`
#### Terraform Validation 🤖\`${{ steps.validate.outcome }}\`
<details><summary>Validation Output</summary>
\`\`\`\n
${{ steps.validate.outputs.stdout }}
\`\`\`
</details>
#### Terraform Plan 📖\`${{ steps.plan.outcome }}\`
<details><summary>Show Plan</summary>
\`\`\`\n
${process.env.PLAN}
\`\`\`
</details>
*Pusher: @${{ github.actor }}, Action: \`${{ github.event_name }}\`, Working Directory: \`${{ env.tf_actions_working_dir }}\`, Workflow: \`${{ github.workflow }}\`*`;
// 3. If we have a comment, update it, otherwise create a new one
if (botComment) {
github.rest.issues.updateComment({
owner: context.repo.owner,
repo: context.repo.repo,
comment_id: botComment.id,
body: output
})
} else {
github.rest.issues.createComment({
issue_number: context.issue.number,
owner: context.repo.owner,
repo: context.repo.repo,
body: output
})
}
# Downloads Regula and checks whether the plan meets compliance requirements.
- name: Regula Compliance Check
shell: bash
working-directory: ${{ env.TERRAFORM_DIRECTORY }}
run: |
REGULA_URL="https://github.com/fugue/regula/releases/download/v${REGULA_VERSION}/regula_${REGULA_VERSION}_Linux_x86_64.tar.gz"
curl -sL "$REGULA_URL" -o regula.tar.gz
tar xzf regula.tar.gz
terraform show -json tfplan | ./regula run
# Deploys infrastructure or changes to infrastructure.
- name: Terraform Apply
if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
working-directory: ${{ env.TERRAFORM_DIRECTORY }}
run: |
terraform apply \
-auto-approve \
-input=false \
-parallelism=${TERRAFORM_PARALLELISM} \
tfplan

View File

@ -1,8 +1,6 @@
# The Swan
# System configuration for my home NAS server
# See [readme](../README.md) to explain how this file works.
{
inputs,
globals,

View File

@ -1,8 +1,6 @@
# The Tempest
# System configuration for my desktop
# See [readme](../README.md) to explain how this file works.
{
inputs,
globals,

15
modules/aws/default.nix Normal file
View File

@ -0,0 +1,15 @@
{ ... }:
{
config = {
# AWS settings require this
permitRootLogin = "prohibit-password";
# Make sure disk size is large enough
# https://github.com/nix-community/nixos-generators/issues/150
formatConfigs.amazon =
{ config, ... }:
{
amazonImage.sizeMB = 16 * 1024;
};
};
}

View File

@ -3,17 +3,20 @@ inputs: _final: prev: {
# Based on:
# https://git.sr.ht/~rycee/nur-expressions/tree/master/item/pkgs/firefox-addons/default.nix#L34
bypass-paywalls-clean = let addonId = "magnolia@12.34";
in prev.stdenv.mkDerivation rec {
pname = "bypass-paywalls-clean";
version = "3.4.9.0";
src = inputs.bypass-paywalls-clean + "/bypass_paywalls_clean-3.6.3.0.xpi";
preferLocalBuild = true;
allowSubstitutes = true;
buildCommand = ''
dst="$out/share/mozilla/extensions/{ec8030f7-c20a-464f-9b0e-13a3a9e97384}"
mkdir -p "$dst"
install -v -m644 "${src}" "$dst/${addonId}.xpi"
'';
};
bypass-paywalls-clean =
let
addonId = "magnolia@12.34";
in
prev.stdenv.mkDerivation rec {
pname = "bypass-paywalls-clean";
version = "3.4.9.0";
src = inputs.bypass-paywalls-clean + "/bypass_paywalls_clean-3.6.3.0.xpi";
preferLocalBuild = true;
allowSubstitutes = true;
buildCommand = ''
dst="$out/share/mozilla/extensions/{ec8030f7-c20a-464f-9b0e-13a3a9e97384}"
mkdir -p "$dst"
install -v -m644 "${src}" "$dst/${addonId}.xpi"
'';
};
}