First PoC on provisioning instance end to end on openstack

nix/modules/nixos/hetzner/default.nix

@@ -24,7 +24,7 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    disko = lib.khscodes.disko-root-lvm {
+    disko = lib.khscodes.disko-root-lvm-uefi {
       device = "/dev/sda";
       diskName = cfg.diskName;
     };

nix/modules/nixos/khs-openstack-instance/default.nix

@@ -184,11 +184,18 @@ in
               khscodes.openstack.compute_instance.compute = {
                 inherit tags;
                 name = fqdn;
-                initial_image = "Ubuntu-22.04";
+                initial_image = "debian-12";
                 flavor = cfg.flavor;
                 ssh_public_key = cfg.ssh_key;
                 firewall_rules = firewallRules;
               };
+              khscodes.unifi.enable = true;
+              khscodes.unifi.static_route.compute = {
+                name = fqdn;
+                network = config.khscodes.openstack.output.compute_instance.compute.ipv6_cidr;
+                distance = 1;
+                next_hop = config.khscodes.openstack.output.compute_instance.compute.ipv6_external_gateway;
+              };
               khscodes.cloudflare = {
                 enable = true;
                 dns = {
@@ -230,15 +237,18 @@ in
         }
       ];
 
-      khscodes.provisioning.pre = {
-        modules = modules;
-        secretsSource = cfg.secretsSource;
-        endpoints = [
-          "aws"
-          "cloudflare"
-          "openstack"
-          "unifi"
-        ];
+      khscodes.provisioning = {
+        pre = {
+          modules = modules;
+          secretsSource = cfg.secretsSource;
+          endpoints = [
+            "aws"
+            "cloudflare"
+            "openstack"
+            "unifi"
+          ];
+        };
+        preImageUsername = "debian";
       };
     }
   );

nix/modules/nixos/openstack/default.nix

@@ -16,11 +16,12 @@ in
     };
   };
   config = lib.mkIf cfg.enable {
-    disko = lib.khscodes.disko-root-lvm {
+    disko = lib.khscodes.disko-root-lvm-bios {
       device = "/dev/sda";
       diskName = cfg.diskName;
     };
-    khscodes.systemd-boot.enable = lib.mkDefault true;
+    boot.loader.grub.efiSupport = false;
+    boot.loader.timeout = 1;
     khscodes.qemu-guest.enable = true;
   };
 }

nix/modules/nixos/provisioning/default.nix

@@ -44,6 +44,11 @@ in
       type = lib.types.nullOr lib.types.path;
       description = "The generated config for the pre provisioning, if any was specified";
     };
+    preImageUsername = lib.mkOption {
+      type = lib.types.str;
+      description = "The username for the image being deployed before being swapped for NixOS";
+      default = "root";
+    };
     postConfig = lib.mkOption {
       type = lib.types.nullOr lib.types.path;
       description = "The generated config for the post provisioning, if any was specified";

nix/modules/nixos/services/openssh/default.nix

@@ -0,0 +1,20 @@
+{ config, lib, ... }:
+let
+  cfg = config.khscodes.services.openssh;
+in
+{
+  options.khscodes.services.openssh = {
+    enable = lib.mkEnableOption "Enables openssh service for the instance";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.openssh = {
+      enable = true;
+      settings = {
+        PasswordAuthentication = false;
+        PermitRootLogin = "no";
+        KbdInteractiveAuthentication = false;
+      };
+    };
+  };
+}

nix/modules/nixos/sshd/default.nix

@@ -1,11 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.khscodes.sshd;
-in
-{
-  options.khscodes.sshd.enable = lib.mkEnableOption "Enables sshd for the instance";
-
-  config = lib.mkIf cfg.enable {
-    services.sshd.enable = true;
-  };
-}

nix/modules/terranix/openstack/output.nix

@@ -21,6 +21,10 @@ let
         type = lib.types.str;
         description = "The IPv6 external gateway for the network. This is useful to eg. create static routes in Unifi";
       };
+      ipv6_cidr = lib.mkOption {
+        type = lib.types.str;
+        description = "IPv6 cidr";
+      };
     };
   };
 in
@@ -44,6 +48,7 @@ in
           ipv4_address = "\${ openstack_networking_floatingip_v2.${sanitizedName}.address }";
           ipv6_address = "\${ data.openstack_networking_port_v2.${sanitizedName}.all_fixed_ips[1] }";
           ipv6_external_gateway = "\${ [for ip in openstack_networking_router_v2.${sanitizedName}.external_fixed_ip : ip.ip_address if replace(ip.ip_address, \":\", \"\") != ip.ip_address][0] }";
+          ipv6_cidr = "\${ openstack_networking_subnet_v2.${sanitizedName}_ip6.cidr }";
         }
       )
     ) cfg.compute_instance;

nix/modules/terranix/unifi/default.nix

@@ -5,19 +5,65 @@ let
   modules = [
     ./output.nix
   ];
+  unifiStaticRouteModule = khscodesLib.mkSubmodule {
+    description = "Unifi static route";
+    options = {
+      network = lib.mkOption {
+        type = lib.types.str;
+        description = "The network to make a static route for";
+      };
+      name = lib.mkOption {
+        type = lib.types.str;
+        description = "Human friendly name of the static route";
+      };
+      distance = lib.mkOption {
+        type = lib.types.int;
+        description = "The distance of the hop";
+      };
+      next_hop = lib.mkOption {
+        type = lib.types.str;
+        description = "The router that can route the network";
+      };
+    };
+  };
 in
 {
   options.khscodes.unifi = {
     enable = lib.mkEnableOption "Enables the unifi provider";
-    bucket = {
-      key = lib.mkOption {
-        type = lib.types.str;
-        description = "key for the bucket to use";
-      };
+    static_route = lib.mkOption {
+      type = lib.types.attrsOf unifiStaticRouteModule;
+      description = "Static routes";
     };
   };
 
   imports = lib.lists.map (m: import m { inherit khscodesLib inputs; }) modules;
 
-  config = lib.mkIf cfg.enable { };
+  config = lib.mkIf cfg.enable {
+    terraform.required_providers.unifi = {
+      source = "paultyng/unifi";
+      version = "= 0.42.0-prerelease";
+    };
+    provider.unifi = {
+      allow_insecure = true;
+    };
+
+    resource.unifi_static_route = lib.mapAttrs' (
+      name: value:
+      let
+        sanitizedName = khscodesLib.sanitize-terraform-name name;
+      in
+      {
+        name = sanitizedName;
+        value = {
+          inherit (value)
+            network
+            name
+            distance
+            next_hop
+            ;
+          type = "nexthop-route";
+        };
+      }
+    ) cfg.static_route;
+  };
 }