First PoC on provisioning instance end to end on openstack

nix/homes/x86_64-linux/khs@test.kaareskovgaard.net/default.nix

@@ -0,0 +1,4 @@
+{
+  snowfallorg.user.name = "khs";
+  home.stateVersion = "25.05";
+}

nix/lib/disko-root-lvm-bios/default.nix

@@ -0,0 +1,53 @@
+{ ... }:
+{
+  disko-root-lvm-bios =
+    {
+      diskName,
+      device,
+      mbrSize ? "1M",
+      bootPartName ? "mbr",
+      rootPartName ? "primary",
+      volumeGroupName ? "mainpool",
+      rootLvName ? "root",
+    }:
+    {
+      devices.disk = {
+        "${diskName}" = {
+          inherit device;
+          type = "disk";
+          content = {
+            type = "gpt";
+            partitions = {
+              "${bootPartName}" = {
+                size = mbrSize;
+                type = "EF02";
+              };
+              "${rootPartName}" = {
+                size = "100%";
+                content = {
+                  type = "lvm_pv";
+                  vg = volumeGroupName;
+                };
+              };
+            };
+          };
+        };
+      };
+      devices.lvm_vg = {
+        "${volumeGroupName}" = {
+          type = "lvm_vg";
+          lvs = {
+            "${rootLvName}" = {
+              size = "100%";
+              content = {
+                type = "filesystem";
+                format = "ext4";
+                mountpoint = "/";
+                mountOptions = [ "defaults" ];
+              };
+            };
+          };
+        };
+      };
+    };
+}

nix/lib/disko-root-lvm-uefi/default.nix

@@ -1,6 +1,6 @@
 { ... }:
 {
-  disko-root-lvm =
+  disko-root-lvm-uefi =
     {
       diskName,
       device,

nix/modules/nixos/hetzner/default.nix

@@ -24,7 +24,7 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    disko = lib.khscodes.disko-root-lvm {
+    disko = lib.khscodes.disko-root-lvm-uefi {
       device = "/dev/sda";
       diskName = cfg.diskName;
     };

nix/modules/nixos/khs-openstack-instance/default.nix

@@ -184,11 +184,18 @@ in
               khscodes.openstack.compute_instance.compute = {
                 inherit tags;
                 name = fqdn;
-                initial_image = "Ubuntu-22.04";
+                initial_image = "debian-12";
                 flavor = cfg.flavor;
                 ssh_public_key = cfg.ssh_key;
                 firewall_rules = firewallRules;
               };
+              khscodes.unifi.enable = true;
+              khscodes.unifi.static_route.compute = {
+                name = fqdn;
+                network = config.khscodes.openstack.output.compute_instance.compute.ipv6_cidr;
+                distance = 1;
+                next_hop = config.khscodes.openstack.output.compute_instance.compute.ipv6_external_gateway;
+              };
               khscodes.cloudflare = {
                 enable = true;
                 dns = {
@@ -230,15 +237,18 @@ in
         }
       ];
 
-      khscodes.provisioning.pre = {
-        modules = modules;
-        secretsSource = cfg.secretsSource;
-        endpoints = [
-          "aws"
-          "cloudflare"
-          "openstack"
-          "unifi"
-        ];
+      khscodes.provisioning = {
+        pre = {
+          modules = modules;
+          secretsSource = cfg.secretsSource;
+          endpoints = [
+            "aws"
+            "cloudflare"
+            "openstack"
+            "unifi"
+          ];
+        };
+        preImageUsername = "debian";
       };
     }
   );

nix/modules/nixos/openstack/default.nix

@@ -16,11 +16,12 @@ in
     };
   };
   config = lib.mkIf cfg.enable {
-    disko = lib.khscodes.disko-root-lvm {
+    disko = lib.khscodes.disko-root-lvm-bios {
       device = "/dev/sda";
       diskName = cfg.diskName;
     };
-    khscodes.systemd-boot.enable = lib.mkDefault true;
+    boot.loader.grub.efiSupport = false;
+    boot.loader.timeout = 1;
     khscodes.qemu-guest.enable = true;
   };
 }

nix/modules/nixos/provisioning/default.nix

@@ -44,6 +44,11 @@ in
       type = lib.types.nullOr lib.types.path;
       description = "The generated config for the pre provisioning, if any was specified";
     };
+    preImageUsername = lib.mkOption {
+      type = lib.types.str;
+      description = "The username for the image being deployed before being swapped for NixOS";
+      default = "root";
+    };
     postConfig = lib.mkOption {
       type = lib.types.nullOr lib.types.path;
       description = "The generated config for the post provisioning, if any was specified";

nix/modules/nixos/services/openssh/default.nix

@@ -0,0 +1,20 @@
+{ config, lib, ... }:
+let
+  cfg = config.khscodes.services.openssh;
+in
+{
+  options.khscodes.services.openssh = {
+    enable = lib.mkEnableOption "Enables openssh service for the instance";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.openssh = {
+      enable = true;
+      settings = {
+        PasswordAuthentication = false;
+        PermitRootLogin = "no";
+        KbdInteractiveAuthentication = false;
+      };
+    };
+  };
+}

nix/modules/nixos/sshd/default.nix

@@ -1,11 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.khscodes.sshd;
-in
-{
-  options.khscodes.sshd.enable = lib.mkEnableOption "Enables sshd for the instance";
-
-  config = lib.mkIf cfg.enable {
-    services.sshd.enable = true;
-  };
-}

nix/modules/terranix/openstack/output.nix

@@ -21,6 +21,10 @@ let
         type = lib.types.str;
         description = "The IPv6 external gateway for the network. This is useful to eg. create static routes in Unifi";
       };
+      ipv6_cidr = lib.mkOption {
+        type = lib.types.str;
+        description = "IPv6 cidr";
+      };
     };
   };
 in
@@ -44,6 +48,7 @@ in
           ipv4_address = "\${ openstack_networking_floatingip_v2.${sanitizedName}.address }";
           ipv6_address = "\${ data.openstack_networking_port_v2.${sanitizedName}.all_fixed_ips[1] }";
           ipv6_external_gateway = "\${ [for ip in openstack_networking_router_v2.${sanitizedName}.external_fixed_ip : ip.ip_address if replace(ip.ip_address, \":\", \"\") != ip.ip_address][0] }";
+          ipv6_cidr = "\${ openstack_networking_subnet_v2.${sanitizedName}_ip6.cidr }";
         }
       )
     ) cfg.compute_instance;

nix/modules/terranix/unifi/default.nix

@@ -5,19 +5,65 @@ let
   modules = [
     ./output.nix
   ];
+  unifiStaticRouteModule = khscodesLib.mkSubmodule {
+    description = "Unifi static route";
+    options = {
+      network = lib.mkOption {
+        type = lib.types.str;
+        description = "The network to make a static route for";
+      };
+      name = lib.mkOption {
+        type = lib.types.str;
+        description = "Human friendly name of the static route";
+      };
+      distance = lib.mkOption {
+        type = lib.types.int;
+        description = "The distance of the hop";
+      };
+      next_hop = lib.mkOption {
+        type = lib.types.str;
+        description = "The router that can route the network";
+      };
+    };
+  };
 in
 {
   options.khscodes.unifi = {
     enable = lib.mkEnableOption "Enables the unifi provider";
-    bucket = {
-      key = lib.mkOption {
-        type = lib.types.str;
-        description = "key for the bucket to use";
-      };
+    static_route = lib.mkOption {
+      type = lib.types.attrsOf unifiStaticRouteModule;
+      description = "Static routes";
     };
   };
 
   imports = lib.lists.map (m: import m { inherit khscodesLib inputs; }) modules;
 
-  config = lib.mkIf cfg.enable { };
+  config = lib.mkIf cfg.enable {
+    terraform.required_providers.unifi = {
+      source = "paultyng/unifi";
+      version = "= 0.42.0-prerelease";
+    };
+    provider.unifi = {
+      allow_insecure = true;
+    };
+
+    resource.unifi_static_route = lib.mapAttrs' (
+      name: value:
+      let
+        sanitizedName = khscodesLib.sanitize-terraform-name name;
+      in
+      {
+        name = sanitizedName;
+        value = {
+          inherit (value)
+            network
+            name
+            distance
+            next_hop
+            ;
+          type = "nexthop-route";
+        };
+      }
+    ) cfg.static_route;
+  };
 }

nix/packages/bw-opentofu/secrets-map.nix

@@ -17,8 +17,8 @@
     TF_VAR_hcloud_api_token = "Terraform API Token";
   };
   "Ubiquiti" = {
-    TF_VAR_unifi_username = "Terraform username";
-    TF_VAR_unifi_password = "Terraform password";
-    TF_VAR_unifi_url = "Terraform URL";
+    UNIFI_USERNAME = "Terraform username";
+    UNIFI_PASSWORD = "Terraform password";
+    UNIFI_API = "Terraform URL";
   };
 }

nix/packages/create-instance/default.nix

@@ -0,0 +1,9 @@
+{ pkgs, ... }:
+pkgs.writeShellApplication {
+  name = "create-instance";
+  runtimeInputs = [ pkgs.khscodes.pre-provisioning ];
+  text = ''
+    instance="''${1:-}"
+    pre-provisioning "$instance" apply
+  '';
+}

nix/packages/destroy-instance/default.nix

@@ -0,0 +1,9 @@
+{ pkgs, ... }:
+pkgs.writeShellApplication {
+  name = "destroy-instance";
+  runtimeInputs = [ pkgs.khscodes.pre-provisioning ];
+  text = ''
+    instance="''${1:-}"
+    pre-provisioning "$instance" destroy
+  '';
+}

nix/packages/nixos-install/default.nix

@@ -0,0 +1,27 @@
+{
+  inputs,
+  pkgs,
+}:
+pkgs.writeShellApplication {
+  name = "nixos-install";
+  runtimeInputs = [
+    pkgs.nix
+    pkgs.nixos-anywhere
+  ];
+  # TODO: Use secret source and required secrets to set up the correct env variables
+  text = ''
+    hostname="$1"
+    # Build the configuration to ensure it doesn't fail when trying to install it on the host
+    nix build --no-link '${inputs.self}#nixosConfigurations."'"$hostname"'".config.system.build.toplevel'
+    # Allow overriding the host to connec tto, this is useful when testing and the DNS entries are stale with older IPs.
+    host="''${2:-$1}"
+    baseAttr='${inputs.self}#nixosConfigurations."'"$hostname"'".config.khscodes.provisioning'
+    config="$(nix build --no-link --print-out-paths "''${baseAttr}.preConfig")"
+    username="$(nix eval --raw "''${baseAttr}.preImageUsername")"
+    if [[ "$config" == "null" ]]; then
+      echo "No preprovisioning needed"
+      exit 0
+    fi
+    nixos-anywhere --flake "${inputs.self}#$hostname" --target-host "$username@$host"
+  '';
+}

nix/packages/terraform-provider-unifi/default.nix

@@ -5,7 +5,7 @@ pkgs.terraform-providers.mkProvider {
   owner = "paultyng";
   repo = "terraform-provider-unifi";
   rev = "ff9c041b3dc4dc6cf6db4c824a43ed6d3ae408d1";
-  version = "v0.42.0-prerelease";
+  version = "0.42.0-prerelease";
   spdx = "MPL-2.0";
   vendorHash = null;
 }

nix/packages/update-instance/default.nix

@@ -0,0 +1,10 @@
+{ inputs, pkgs, ... }:
+pkgs.writeShellApplication {
+  name = "update-instance";
+  runtimeInputs = [ pkgs.nixos-rebuild ];
+  text = ''
+    instance="''${1:-}"
+    connect_host="''${2:-$1}"
+    nixos-rebuild switch --flake "${inputs.self}#$instance" --target-host "$connect_host" --build-host "localhost"
+  '';
+}

nix/packages/upload-openstack-base-debian-image/default.nix

@@ -0,0 +1,54 @@
+{ pkgs, ... }:
+let
+  image = pkgs.fetchurl {
+    url = "https://cdimage.debian.org/images/cloud/bookworm/20250703-2162/debian-12-genericcloud-amd64-20250703-2162.qcow2";
+    hash = "sha256-hfcP4INSfyP90f9DWDqMLXsZa7teXMhePwK6Vyk+dG4=";
+  };
+  script = pkgs.writeShellApplication {
+    name = "upload-openstack-base-debian-image-wrapped";
+    runtimeInputs = [
+      pkgs.openstackclient
+    ];
+    text = ''
+      export OS_AUTH_URL="''${TF_VAR_openstack_auth_url:-}"
+      # With the addition of Keystone we have standardized on the term **project**
+      # as the entity that owns the resources.
+      # export OS_PROJECT_ID=4840ee3bdd0e4285bc46586b8e14aafb
+      export OS_PROJECT_NAME="khs"
+      export OS_USER_DOMAIN_NAME="Default"
+      export OS_PROJECT_DOMAIN_ID="default"
+      # In addition to the owning entity (tenant), OpenStack stores the entity
+      # performing the action as the **user**.
+      export OS_USERNAME="''${TF_VAR_openstack_username:-}"
+      export OS_PASSWORD="''${TF_VAR_openstack_password:-}"
+      # If your configuration has multiple regions, we set that information here.
+      # OS_REGION_NAME is optional and only valid in certain environments.
+      export OS_REGION_NAME="''${TF_VAR_openstack_region:-}"
+      export OS_INTERFACE="''${TF_VAR_endpoint_type:-}"
+      export OS_IDENTITY_API_VERSION=3
+
+
+      openstack image create \
+        --container-format bare \
+        --disk-format qcow2 \
+        --property hw_disk_bus=scsi \
+        --property hw_scsi_model=virtio-scsi \
+        --property os_type=linux \
+        --property os_distro=debian \
+        --property os_admin_user=debian \
+        --property os_version='12.0.0' \
+        --file ${image} \
+        debian-12
+    '';
+  };
+in
+pkgs.writeShellApplication {
+  name = "upload-openstack-base-debian-image";
+  runtimeInputs = [
+    pkgs.khscodes.openbao-helper
+    script
+  ];
+  text = ''
+    openbao-helper wrap-program -e openstack -- upload-openstack-base-debian-image-wrapped
+  '';
+}

nix/profiles/hetzner-server.nix

@@ -2,6 +2,6 @@
 {
   config.khscodes = {
     hetzner.enable = true;
-    sshd.enable = true;
+    services.openssh.enable = true;
   };
 }

nix/profiles/khs-openstack-server.nix

@@ -2,6 +2,6 @@
 {
   config.khscodes = {
     openstack.enable = true;
-    sshd.enable = true;
+    services.openssh.enable = true;
   };
 }

nix/systems/x86_64-linux/test.kaareskovgaard.net/default.nix

@@ -9,6 +9,13 @@
     flavor = "m.medium";
     secretsSource = "vault";
   };
+  snowfallorg.users.khs.admin = true;
+  users.users.khs = {
+    initialPassword = "test";
+    openssh.authorizedKeys.keys = [
+      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCqY0FHnWFKfLG2yfgr4qka5sR9CK+EMAhzlHUkaQyWHTKD+G0/vC/fNPyL1VV3Dxc/ajxGuPzVE+mBMoyxazL3EtuCDOVvHJ5CR+MUSEckg/DDwcGHqy6rC8BvVVpTAVL04ByQdwFnpE1qNSBaQLkxaFVdtriGKkgMkc7+UNeYX/bv7yn+APqfP1a3xr6wdkSSdO8x4N2jsSygOIMx10hLyCV4Ueu7Kp8Ww4rGY8j5o7lKJhbgfItBfSOuQHdppHVF/GKYRhdnK6Y2fZVYbhq4KipUtclbZ6O/VYd8/sOO98+LMm7cOX+K35PQjUpYgcoNy5+Sw3CNS/NHn4JvOtTaUEYP7fK6c9LhMULOO3T7Cm6TMdiFjUKHkyG+s2Mu/LXJJoilw571zwuh6chkeitW8+Ht7k0aPV96kNEvTdoXwLhBifVEaChlAsLAzSUjUq+YYCiXVk0VIXCZQWKj8LoVNTmaqDksWwbcT64fw/FpVC0N18WHbKcFUEIW/O4spJMa30CQwf9FeqpoWoaF1oRClCSDPvX0AauCu0JcmRinz1/JmlXljnXWbSfm20/V+WyvktlI0wTD0cdpNuSasT9vS77YfJ8nutcWWZKSkCj4R4uHeCNpDTX5YXzapy7FxpM9ANCXLIvoGX7Yafba2Po+er7SSsUIY1AsnBBr8ZoDVw=="
+    ];
+  };
   khscodes.fqdn = "test.kaareskovgaard.net";
   system.stateVersion = "25.05";
 }