.github/workflows/arrow.yml

@@ -3,7 +3,7 @@ name: Arrow
 run-name: Arrow - ${{ inputs.rebuild && 'Rebuild and ' || '' }}${{ inputs.action == 'create' && 'Create' || ( inputs.action == 'destroy' && 'Destroy' || 'No Action' ) }}
 
 env:
-  TERRAFORM_DIRECTORY: hosts/arrow/vultr
+  TERRAFORM_DIRECTORY: hosts/arrow
   DEPLOY_IDENTITY_BASE64: ${{ secrets.DEPLOY_IDENTITY_BASE64 }}
   ARROW_IDENTITY_BASE64: ${{ secrets.ARROW_IDENTITY_BASE64 }}
   CLOUDFLARE_R2_ENDPOINT: "${{ secrets.CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com"
@@ -65,7 +65,7 @@ jobs:
       # Build the image
       - name: Build Image
         if: inputs.rebuild && inputs.action != 'destroy'
-        run: nix build .#arrow
+        run: nix build .#image.arrow
 
       - name: Upload Image to S3
         if: inputs.rebuild && inputs.action != 'destroy'

flake.lock

@@ -126,11 +126,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1712947906,
+        "lastModified": 1712612224,
-        "narHash": "sha256-T0eT2lMbcK7RLelkx0qx4SiFpOS/0dt0aSfLB+WsGV8=",
+        "narHash": "sha256-Tv4C8OSPVmm4LbpJGLFSODyvJy6DqrisEGPCQdNVOeY=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "8d4ae698eaac8bd717e23507da2ca8b345bec4b5",
+        "rev": "79eab0e82cb126bf4ac170f44af82479f0895ab5",
         "type": "github"
       },
       "original": {
@@ -163,11 +163,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1713055748,
+        "lastModified": 1712623312,
-        "narHash": "sha256-LlFkVfdF9GfB02gFNHjnLOV0AQYFY7gWATlniTALeaM=",
+        "narHash": "sha256-6NlzHMtxCdlF+Zq1Y10YnVr5M/AgMcVhEMZlxlQyeNo=",
         "owner": "bandithedoge",
         "repo": "nixpkgs-firefox-darwin",
-        "rev": "10e4a50241d6bbae62754efda7bc4b48dd4aa2c1",
+        "rev": "49b3ee7dbb9fdbb6388bd5d47895a9a9992b771e",
         "type": "github"
       },
       "original": {
@@ -215,11 +215,11 @@
         "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1710146030,
+        "lastModified": 1705309234,
-        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
         "type": "github"
       },
       "original": {
@@ -251,11 +251,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1713077896,
+        "lastModified": 1712688495,
-        "narHash": "sha256-Noot8H0EZEAFRQWyGxh9ryvhK96xpIqKbh78X447JWs=",
+        "narHash": "sha256-NrVLXkpT9ZigiI8md6NIzHS+3lE4QTj30IgXG57O9iM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "630a0992b3627c64e34f179fab68e3d48c6991c0",
+        "rev": "b00d0e4fe9cba0047f54e77418ddda5f17e6ef2c",
         "type": "github"
       },
       "original": {
@@ -323,7 +323,7 @@
     "nextcloud-snappymail": {
       "flake": false,
       "locked": {
-        "lastModified": 1713097756,
+        "lastModified": 1712695892,
         "narHash": "sha256-UeZXoZFEPJj7zEVNTXJ3IYNt/wI7VFq3Pjh1ubMHCBo=",
         "type": "tarball",
         "url": "https://snappymail.eu/repository/nextcloud/snappymail-2.32.0-nextcloud.tar.gz"
@@ -408,11 +408,11 @@
     },
     "nur": {
       "locked": {
-        "lastModified": 1713093341,
+        "lastModified": 1712692796,
-        "narHash": "sha256-zON2LEPO98NiUtOItgu+Vz1uWkrUbt5zJbzf5XCm71Y=",
+        "narHash": "sha256-q3Tx4kS+nH4IDcEsZSv8o2IuCn475mGhCYBXxfxZ2gY=",
         "owner": "nix-community",
         "repo": "nur",
-        "rev": "1e6e9f41f0fbdcba7ca505a7d54128bc2f1053d6",
+        "rev": "ee4ce451f46a08778d1a9f9837eff0750714b08b",
         "type": "github"
       },
       "original": {
@@ -473,11 +473,11 @@
     "nvim-treesitter-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1713097426,
+        "lastModified": 1712690702,
-        "narHash": "sha256-rtE1H24sKekGwTIMh7VXkwKVCbJtn8ms4ioK9gF+KxY=",
+        "narHash": "sha256-iWP5nIswAs+7oNBhJpPzBqJ5BLXEt8+kHPi22RtAK3Q=",
         "owner": "nvim-treesitter",
         "repo": "nvim-treesitter",
-        "rev": "d2f4c7830377d6d036e9621ae696dbd28f089897",
+        "rev": "c16f66cca0c38b4e21371d8330b7f2ad6404f6dc",
         "type": "github"
       },
       "original": {
@@ -660,11 +660,11 @@
     "tree-sitter-bash": {
       "flake": false,
       "locked": {
-        "lastModified": 1712878661,
+        "lastModified": 1710290046,
-        "narHash": "sha256-sj1qYb42k0hXXcNCKg1hINYD11wDcVpnoPhZNtlYT6k=",
+        "narHash": "sha256-6Rfxh8Y6dg2wyQ9jYnbOaXm1SVfQDQ1B1tNqgpz6sY4=",
         "owner": "tree-sitter",
         "repo": "tree-sitter-bash",
-        "rev": "f8fb3274f72a30896075585b32b0c54cad65c086",
+        "rev": "f3f26f47a126797c011c311cec9d449d855c3eab",
         "type": "github"
       },
       "original": {
@@ -797,11 +797,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1712984363,
+        "lastModified": 1710519878,
-        "narHash": "sha256-VgCqYB+ymQuZmno8B82L8piyENo5xTNuqubnACYoBRk=",
+        "narHash": "sha256-0dbc10OBFUVYyXC+C+N6vRUd8xyBSRxkcZ4Egipbx0M=",
         "owner": "nix-community",
         "repo": "NixOS-WSL",
-        "rev": "0479d4c1ebeb314c5281b4aa7109def821a1b27b",
+        "rev": "aef95bdb6800a3a2af7aa7083d6df03067da6592",
         "type": "github"
       },
       "original": {

flake.nix

@@ -22,7 +22,8 @@
     # Used for user packages and dotfiles
     home-manager = {
       url = "github:nix-community/home-manager/master";
-      inputs.nixpkgs.follows = "nixpkgs"; # Use system packages list for their inputs
+      inputs.nixpkgs.follows =
+        "nixpkgs"; # Use system packages list for their inputs
     };
 
     # Community packages; used for Firefox extensions
@@ -178,75 +179,78 @@
     # Alternatively, could consider using https://github.com/fufexan/nix-gaming
     proton-ge = {
       # https://github.com/GloriousEggroll/proton-ge-custom/releases
-      url = "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/GE-Proton9-2/GE-Proton9-2.tar.gz";
+      url =
+        "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/GE-Proton9-2/GE-Proton9-2.tar.gz";
       flake = false;
     };
 
     # Firefox addon from outside the extension store
     bypass-paywalls-clean = {
       # https://gitlab.com/magnolia1234/bpc-uploads/-/commits/master/?ref_type=HEADS
-      url = "git+https://git.masu.rs/noah/bpc-uploads"; # temporary, shouldn't rely on myself
+      url =
+        "git+https://git.masu.rs/noah/bpc-uploads"; # temporary, shouldn't rely on myself
       flake = false;
     };
 
     # Nextcloud Apps
     nextcloud-news = {
       # https://github.com/nextcloud/news/releases
-      url = "https://github.com/nextcloud/news/releases/download/25.0.0-alpha3/news.tar.gz";
+      url =
+        "https://github.com/nextcloud/news/releases/download/25.0.0-alpha3/news.tar.gz";
       flake = false;
     };
     nextcloud-external = {
       # https://github.com/nextcloud-releases/external/releases
-      url = "https://github.com/nextcloud-releases/external/releases/download/v5.3.1/external-v5.3.1.tar.gz";
+      url =
+        "https://github.com/nextcloud-releases/external/releases/download/v5.3.1/external-v5.3.1.tar.gz";
       flake = false;
     };
     nextcloud-cookbook = {
       # https://github.com/christianlupus-nextcloud/cookbook-releases/releases/
-      url = "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.0/cookbook-0.11.0.tar.gz";
+      url =
+        "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.0/cookbook-0.11.0.tar.gz";
       flake = false;
     };
     nextcloud-snappymail = {
       # https://github.com/the-djmaze/snappymail/releases
-      url = "https://snappymail.eu/repository/nextcloud/snappymail-2.32.0-nextcloud.tar.gz";
+      url =
+        "https://snappymail.eu/repository/nextcloud/snappymail-2.32.0-nextcloud.tar.gz";
       flake = false;
     };
+
   };
 
-  outputs =
+  outputs = { nixpkgs, ... }@inputs:
-    { nixpkgs, ... }@inputs:
 
     let
 
       # Global configuration for my systems
-      globals =
+      globals = let baseName = "masu.rs";
-        let
+      in rec {
-          baseName = "masu.rs";
+        user = "noah";
-        in
+        fullName = "Noah Masur";
-        rec {
+        gitName = fullName;
-          user = "noah";
+        gitEmail = "7386960+nmasur@users.noreply.github.com";
-          fullName = "Noah Masur";
+        mail.server = "noahmasur.com";
-          gitName = fullName;
+        mail.imapHost = "imap.purelymail.com";
-          gitEmail = "7386960+nmasur@users.noreply.github.com";
+        mail.smtpHost = "smtp.purelymail.com";
-          mail.server = "noahmasur.com";
+        dotfilesRepo = "https://github.com/nmasur/dotfiles";
-          mail.imapHost = "imap.purelymail.com";
+        hostnames = {
-          mail.smtpHost = "smtp.purelymail.com";
+          git = "git.${baseName}";
-          dotfilesRepo = "https://github.com/nmasur/dotfiles";
+          influxdb = "influxdb.${baseName}";
-          hostnames = {
+          irc = "irc.${baseName}";
-            git = "git.${baseName}";
+          metrics = "metrics.${baseName}";
-            influxdb = "influxdb.${baseName}";
+          minecraft = "minecraft.${baseName}";
-            irc = "irc.${baseName}";
+          prometheus = "prom.${baseName}";
-            metrics = "metrics.${baseName}";
+          paperless = "paper.${baseName}";
-            minecraft = "minecraft.${baseName}";
+          secrets = "vault.${baseName}";
-            prometheus = "prom.${baseName}";
+          stream = "stream.${baseName}";
-            paperless = "paper.${baseName}";
+          content = "cloud.${baseName}";
-            secrets = "vault.${baseName}";
+          books = "books.${baseName}";
-            stream = "stream.${baseName}";
+          download = "download.${baseName}";
-            content = "cloud.${baseName}";
+          transmission = "transmission.${baseName}";
-            books = "books.${baseName}";
-            download = "download.${baseName}";
-            transmission = "transmission.${baseName}";
-          };
         };
+      };
 
       # Common overlays to always use
       overlays = [
@@ -267,17 +271,13 @@
       ];
 
       # System types to support.
-      supportedSystems = [
+      supportedSystems =
-        "x86_64-linux"
+        [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin" ];
-        "x86_64-darwin"
-        "aarch64-linux"
-        "aarch64-darwin"
-      ];
 
       # Helper function to generate an attrset '{ x86_64-linux = f "x86_64-linux"; ... }'.
       forAllSystems = nixpkgs.lib.genAttrs supportedSystems;
-    in
+
-    rec {
+    in rec {
 
       # Contains my full system builds, including home-manager
       # nixos-rebuild switch --flake .#tempest
@@ -292,84 +292,65 @@
       # Contains my full Mac system builds, including home-manager
       # darwin-rebuild switch --flake .#lookingglass
       darwinConfigurations = {
-        lookingglass = import ./hosts/lookingglass { inherit inputs globals overlays; };
+        lookingglass =
+          import ./hosts/lookingglass { inherit inputs globals overlays; };
       };
 
       # For quickly applying home-manager settings with:
       # home-manager switch --flake .#tempest
       homeConfigurations = {
-        tempest = nixosConfigurations.tempest.config.home-manager.users.${globals.user}.home;
+        tempest =
-        lookingglass = darwinConfigurations.lookingglass.config.home-manager.users."Noah.Masur".home;
+          nixosConfigurations.tempest.config.home-manager.users.${globals.user}.home;
+        lookingglass =
+          darwinConfigurations.lookingglass.config.home-manager.users."Noah.Masur".home;
       };
 
       # Disk formatting, only used once
-      diskoConfigurations = {
+      diskoConfigurations = { root = import ./disks/root.nix; };
-        root = import ./disks/root.nix;
-      };
 
-      packages =
+      packages = let
-        let
+        arrow = system:
-          arrow =
+          import ./hosts/arrow { inherit inputs globals overlays system; };
-            system:
+        aws = system:
-            import ./hosts/arrow {
+          import ./hosts/aws { inherit inputs globals overlays system; };
-              inherit
+        staff = system:
-                inputs
+          import ./hosts/staff { inherit inputs globals overlays system; };
-                globals
+        neovim = system:
-                overlays
+          let pkgs = import nixpkgs { inherit system overlays; };
-                system
+          in import ./modules/common/neovim/package {
-                ;
+            inherit pkgs;
-            };
+            colors = (import ./colorscheme/gruvbox-dark).dark;
-          staff =
+          };
-            system:
+      in {
-            import ./hosts/staff {
+        x86_64-linux.arrow = arrow "x86_64-linux";
-              inherit
+        x86_64-linux.aws = aws "x86_64-linux";
-                inputs
+        x86_64-linux.staff = staff "x86_64-linux";
-                globals
+        x86_64-linux.image = {
-                overlays
+          arrow = inputs.nixos-generators.nixosGenerate {
-                system
-                ;
-            };
-          neovim =
-            system:
-            let
-              pkgs = import nixpkgs { inherit system overlays; };
-            in
-            import ./modules/common/neovim/package {
-              inherit pkgs;
-              colors = (import ./colorscheme/gruvbox-dark).dark;
-            };
-        in
-        {
-          x86_64-linux.staff = staff "x86_64-linux";
-          x86_64-linux.arrow = inputs.nixos-generators.nixosGenerate {
             system = "x86_64-linux";
             format = "iso";
-            modules = import ./hosts/arrow/modules.nix { inherit inputs globals overlays; };
+            modules = import ./hosts/arrow/modules.nix {
+              inherit inputs globals overlays;
+            };
           };
-
-          # Package Neovim config into standalone package
-          x86_64-linux.neovim = neovim "x86_64-linux";
-          x86_64-darwin.neovim = neovim "x86_64-darwin";
-          aarch64-linux.neovim = neovim "aarch64-linux";
-          aarch64-darwin.neovim = neovim "aarch64-darwin";
         };
 
+        # Package Neovim config into standalone package
+        x86_64-linux.neovim = neovim "x86_64-linux";
+        x86_64-darwin.neovim = neovim "x86_64-darwin";
+        aarch64-linux.neovim = neovim "aarch64-linux";
+        aarch64-darwin.neovim = neovim "aarch64-darwin";
+      };
+
       # Programs that can be run by calling this flake
-      apps = forAllSystems (
+      apps = forAllSystems (system:
-        system:
+        let pkgs = import nixpkgs { inherit system overlays; };
-        let
+        in import ./apps { inherit pkgs; });
-          pkgs = import nixpkgs { inherit system overlays; };
-        in
-        import ./apps { inherit pkgs; }
-      );
 
       # Development environments
-      devShells = forAllSystems (
+      devShells = forAllSystems (system:
-        system:
+        let pkgs = import nixpkgs { inherit system overlays; };
-        let
+        in {
-          pkgs = import nixpkgs { inherit system overlays; };
-        in
-        {
 
           # Used to run commands and edit files in this repo
           default = pkgs.mkShell {
@@ -438,5 +419,6 @@
           description = "Rust template";
         };
       };
+
     };
 }

hosts/arrow/default.nix

@@ -1,6 +1,3 @@
-# The Arrow
-# System configuration for temporary VM
-
 {
   inputs,
   globals,

hosts/aws/default.nix

@@ -0,0 +1,41 @@
+{
+  inputs,
+  system,
+  globals,
+  overlays,
+  ...
+}:
+
+inputs.nixos-generators.nixosGenerate {
+  inherit system;
+  format = "amazon";
+  modules =
+    [
+      globals
+      inputs.home-manager.nixosModules.home-manager
+      {
+        nixpkgs.overlays = overlays;
+        networking.hostName = "sheep";
+        gui.enable = false;
+        theme.colors = (import ../../colorscheme/gruvbox).dark;
+        passwordHash = null;
+        publicKeys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s personal"
+        ];
+        # AWS settings require this
+        permitRootLogin = "prohibit-password";
+      }
+      ../../modules/common
+      ../../modules/nixos
+      ../../modules/nixos/services/sshd.nix
+    ]
+    ++ [
+      # Required to fix diskSize errors during build
+      (
+        { ... }:
+        {
+          amazonImage.sizeMB = 16 * 1024;
+        }
+      )
+    ];
+}

hosts/aws/main.tf

@@ -26,7 +26,7 @@ data "aws_iam_policy_document" "vmimport" {
     actions = [
       "s3:GetBucketLocation",
       "s3:GetObject",
-      "s3:ListBucket",
+        "s3:ListBucket",
     ]
     resources = [
       "arn:aws:s3:::${aws_s3_object.image.bucket}",

hosts/aws/workflow.yml

@@ -0,0 +1,280 @@
+name: 'Terraform'
+env:
+
+  AWS_ACCOUNT_NUMBER: ''
+  AWS_PLAN_ROLE_NAME: github_actions_plan
+  AWS_APPLY_ROLE_NAME: github_actions_admin
+
+  # Always required. Used for authenticating to AWS, but can also act as your
+  # default region if you don't want to specify in the provider configuration.
+  AWS_REGION: us-east-1
+
+  # You must change these to fit your project.
+  TF_VAR_project: change-me
+  TF_VAR_label: change-me
+  TF_VAR_owner: Your Name Here
+
+  # If storing Terraform in a subdirectory, specify it here.
+  TERRAFORM_DIRECTORY: .
+
+  # Pinned versions of tools to use.
+  # Check for new releases:
+  # - https://github.com/hashicorp/terraform/releases
+  # - https://github.com/fugue/regula/releases
+  # - https://github.com/terraform-linters/tflint/releases
+  TERRAFORM_VERSION: 1.2.6
+  REGULA_VERSION: 2.9.0
+  TFLINT_VERSION: 0.39.1
+
+  # Terraform configuration options
+  TERRAFORM_PARALLELISM: 10
+
+  # These variables are passed to Terraform based on GitHub information.
+  TF_VAR_repo: ${{ github.repository }}
+
+# This workflow is triggered in the following ways.
+on:
+
+  # Any push or merge to these branches.
+  push:
+    branches:
+      - dev
+      - prod
+
+  # Any pull request targeting these branches (plan only).
+  pull_request:
+    branches:
+      - dev
+      - prod
+
+
+  # Any manual trigger on these branches.
+  workflow_dispatch:
+    branches:
+      - dev
+      - prod
+
+# -------------------------------------------------------------------
+# The rest of this workflow can operate without adjustments. Edit the
+# below content at your own risk!
+# -------------------------------------------------------------------
+
+# Used to connect to AWS IAM
+permissions:
+  id-token: write
+  contents: read
+  pull-requests: write
+
+# Only run one workflow at a time for each Terraform state. This prevents
+# lockfile conflicts, especially during PR vs push.
+concurrency: terraform-${{ github.base_ref || github.ref }}
+
+jobs:
+  terraform:
+
+    name: 'Terraform'
+
+    # Change this if you need to run your deployment on-prem.
+    runs-on: ubuntu-latest
+
+    steps:
+
+      # Downloads the current repo code to the runner.
+      - name: Checkout Repo Code
+        uses: actions/checkout@v3
+
+      # Enable access to KVM, required to build an image
+      - name: Enable KVM group perms
+        run: |
+            echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+            sudo udevadm control --reload-rules
+            sudo udevadm trigger --name-match=kvm
+
+      # Login to AWS
+      - name: AWS Assume Role
+        uses: aws-actions/configure-aws-credentials@v1.6.1
+        with:
+          role-to-assume: ${{ env.AWS_ROLE_ARN }}
+          aws-region: ${{ env.AWS_REGION }}
+
+      # Install Nix
+      - name: Install Nix
+        uses: cachix/install-nix-action@v17
+        with:
+          extra_nix_config: |
+            substituters = s3://insert-cache-bucket https://cache.nixos.org/
+            trusted-public-keys = insert-cache-bucket:M6PsZjHXcLvbQyPUBLICKEYGVoNwI84g1FBQzouRU= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
+
+      # Build the image
+      - name: Build Image
+        run: nix build .#aws
+
+      # Copy the image to S3
+      - name: Upload Image to Cache
+        env:
+          NIX_CACHE_PRIVATE_KEY: ${{ secrets.NIX_CACHE_PRIVATE_KEY }}
+        run: |
+          echo "$NIX_CACHE_PRIVATE_KEY" > cache.key
+          nix store sign --key-file cache.key $(readlink result)
+          nix copy --to s3://t2-aws-nixos-test $(readlink result)
+          rm cache.key
+
+      # Exports all GitHub Secrets as environment variables prefixed by
+      # "TF_VAR_", which exposes them to Terraform. The name of each GitHub
+      # Secret must match its Terraform variable name exactly.
+      - name: Export Secrets to Terraform Variables
+        env:
+          ALL_SECRETS: ${{ toJson(secrets) }}
+        run: |
+          echo "$ALL_SECRETS" \
+            | jq "to_entries | .[] | \"TF_VAR_\" + ( .key | ascii_downcase ) + \"=\" + .value" \
+            | tr -d \" >> $GITHUB_ENV
+
+      # Installs the Terraform binary and some other accessory functions.
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v2
+        with:
+          terraform_version: ${{ env.TERRAFORM_VERSION }}
+
+      # Checks whether Terraform is formatted properly. If this fails, you
+      # should install the pre-commit hook.
+      - name: Check Formatting
+        run: |
+          terraform fmt -no-color -check -diff -recursive
+
+      # Downloads a Terraform code lint test.
+      - uses: terraform-linters/setup-tflint@v1
+        name: Setup TFLint
+        with:
+          tflint_version: v${{ env.TFLINT_VERSION }}
+
+      # Sets up linting with this codebase.
+      - name: Init TFLint
+        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
+        run: tflint --init
+
+      # Lints the current code.
+      - name: Run TFLint
+        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
+        run: |
+          tflint -f compact
+          find ./modules/* -type d -maxdepth 0 | xargs -I __ tflint -f compact --disable-rule=terraform_required_providers --disable-rule=terraform_required_version __
+
+      # Connects to remote state backend and download providers.
+      - name: Terraform Init
+        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
+        run: |
+          terraform init \
+            -backend-config="role_arn=${{ env.AWS_STATE_ROLE_ARN }}" \
+            -backend-config="region=us-east-1" \
+            -backend-config="workspace_key_prefix=accounts/${{ env.AWS_ACCOUNT_NUMBER }}/${{ github.repository }}" \
+            -backend-config="key=state.tfstate" \
+            -backend-config="dynamodb_table=global-tf-state-lock"
+
+      # Set the Terraform Workspace to the current branch name.
+      - name: Set Terraform Workspace
+        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
+        shell: bash
+        run: |
+          export WORKSPACE=${{ github.base_ref || github.ref_name }}
+          terraform workspace select ${WORKSPACE} || terraform workspace new $WORKSPACE
+          echo "TF_WORKSPACE=$(echo ${WORKSPACE} | sed 's/\//_/g')" >> $GITHUB_ENV
+
+      # Checks differences between current code and infrastructure state.
+      - name: Terraform Plan
+        id: plan
+        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
+        run: |
+          terraform plan \
+            -input=false \
+            -no-color \
+            -out=tfplan \
+            -parallelism=${TERRAFORM_PARALLELISM} \
+            -var-file=variables-${TF_WORKSPACE}.tfvars
+
+      # Gets the results of the plan for pull requests.
+      - name: Terraform Show Plan
+        id: show
+        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
+        run: terraform show -no-color tfplan
+
+      # Adds the results of the plan to the pull request.
+      - name: Comment Plan
+        uses: actions/github-script@v6
+        if: github.event_name == 'pull_request'
+        env:
+          STDOUT: "```terraform\n${{ steps.show.outputs.stdout }}```"
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            // 1. Retrieve existing bot comments for the PR
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+            })
+            const botComment = comments.find(comment => {
+              return comment.user.type === 'Bot' && comment.body.includes('Terraform Format and Style')
+            })
+
+            // 2. Prepare format of the comment
+            const output = `#### Terraform Format and Style 🖌\`${{ steps.fmt.outcome }}\`
+            #### Terraform Initialization ⚙️\`${{ steps.init.outcome }}\`
+            #### Terraform Validation 🤖\`${{ steps.validate.outcome }}\`
+            <details><summary>Validation Output</summary>
+
+            \`\`\`\n
+            ${{ steps.validate.outputs.stdout }}
+            \`\`\`
+
+            </details>
+
+            #### Terraform Plan 📖\`${{ steps.plan.outcome }}\`
+
+            <details><summary>Show Plan</summary>
+
+            \`\`\`\n
+            ${process.env.PLAN}
+            \`\`\`
+
+            </details>
+
+            *Pusher: @${{ github.actor }}, Action: \`${{ github.event_name }}\`, Working Directory: \`${{ env.tf_actions_working_dir }}\`, Workflow: \`${{ github.workflow }}\`*`;
+
+            // 3. If we have a comment, update it, otherwise create a new one
+            if (botComment) {
+              github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: botComment.id,
+                body: output
+              })
+            } else {
+              github.rest.issues.createComment({
+                issue_number: context.issue.number,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                body: output
+              })
+            }
+
+      # Downloads Regula and checks whether the plan meets compliance requirements.
+      - name: Regula Compliance Check
+        shell: bash
+        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
+        run: |
+          REGULA_URL="https://github.com/fugue/regula/releases/download/v${REGULA_VERSION}/regula_${REGULA_VERSION}_Linux_x86_64.tar.gz"
+          curl -sL "$REGULA_URL" -o regula.tar.gz
+          tar xzf regula.tar.gz
+          terraform show -json tfplan | ./regula run
+
+      # Deploys infrastructure or changes to infrastructure.
+      - name: Terraform Apply
+        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
+        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
+        run: |
+          terraform apply \
+            -auto-approve \
+            -input=false \
+            -parallelism=${TERRAFORM_PARALLELISM} \
+            tfplan

hosts/swan/default.nix

@@ -1,6 +1,8 @@
 # The Swan
 # System configuration for my home NAS server
 
+# See [readme](../README.md) to explain how this file works.
+
 {
   inputs,
   globals,

hosts/tempest/default.nix

@@ -1,6 +1,8 @@
 # The Tempest
 # System configuration for my desktop
 
+# See [readme](../README.md) to explain how this file works.
+
 {
   inputs,
   globals,

modules/aws/default.nix

@@ -1,15 +0,0 @@
-{ ... }:
-{
-  config = {
-    # AWS settings require this
-    permitRootLogin = "prohibit-password";
-
-    # Make sure disk size is large enough
-    # https://github.com/nix-community/nixos-generators/issues/150
-    formatConfigs.amazon =
-      { config, ... }:
-      {
-        amazonImage.sizeMB = 16 * 1024;
-      };
-  };
-}

overlays/bypass-paywalls-clean.nix

@@ -3,20 +3,17 @@ inputs: _final: prev: {
   # Based on:
   # https://git.sr.ht/~rycee/nur-expressions/tree/master/item/pkgs/firefox-addons/default.nix#L34
 
-  bypass-paywalls-clean =
+  bypass-paywalls-clean = let addonId = "magnolia@12.34";
-    let
+  in prev.stdenv.mkDerivation rec {
-      addonId = "magnolia@12.34";
+    pname = "bypass-paywalls-clean";
-    in
+    version = "3.4.9.0";
-    prev.stdenv.mkDerivation rec {
+    src = inputs.bypass-paywalls-clean + "/bypass_paywalls_clean-3.6.3.0.xpi";
-      pname = "bypass-paywalls-clean";
+    preferLocalBuild = true;
-      version = "3.4.9.0";
+    allowSubstitutes = true;
-      src = inputs.bypass-paywalls-clean + "/bypass_paywalls_clean-3.6.3.0.xpi";
+    buildCommand = ''
-      preferLocalBuild = true;
+      dst="$out/share/mozilla/extensions/{ec8030f7-c20a-464f-9b0e-13a3a9e97384}"
-      allowSubstitutes = true;
+      mkdir -p "$dst"
-      buildCommand = ''
+      install -v -m644 "${src}" "$dst/${addonId}.xpi"
-        dst="$out/share/mozilla/extensions/{ec8030f7-c20a-464f-9b0e-13a3a9e97384}"
+    '';
-        mkdir -p "$dst"
+  };
-        install -v -m644 "${src}" "$dst/${addonId}.xpi"
-      '';
-    };
 }