Repository for AFNix-managed infrastructure
https://hydra.afnix.fr/project/infra
- Nix 82.2%
- Python 6.1%
- Rust 4.9%
- Go 2.5%
- JavaScript 2.4%
- Other 1.9%
Pierre Bourdon
9362acea52
Remove the static binary upload until we can figure out upload to
multiple s3 bucket destinations (since docs.lix.systems isn't a great
home for it...).
Change-Id:
|
||
|---|---|---|
| arcana | ||
| common | ||
| dashboards | ||
| dnscontrol | ||
| hosts/afnix | ||
| lib | ||
| macos/mdm-scripts | ||
| netboot/arm64 | ||
| overlays | ||
| pki | ||
| secrets | ||
| services | ||
| terraform | ||
| vm | ||
| .editorconfig | ||
| .envrc | ||
| .gitattributes | ||
| .gitignore | ||
| baremetal-nodes.nix | ||
| default.nix | ||
| flake.lock | ||
| flake.nix | ||
| LICENSE | ||
| README.md | ||
| renovate.json | ||
| secrets.nix | ||
| tasks.py | ||
Infrastructure for the donut shaped thing that is absolutely not a donut.
Quick start
Enter our dev-shell for things like our arcana wrapper, secrets helper and required binaries:
$ nix develop
Build the infrastructure
$ arcana build --on @localboot
Notice that @localboot is load-bearing as we have some machines that cannot be deployed with vanilla arcana. Fixing this is welcome.
Recommended deploy process
$ arcana apply dry-activate $machine # Verify that the nvd log is reasonable.
$ arcana apply $machine
Recommended upgrade process
$ nix flake update
$ arcana apply dry-activate --on @localboot # Verify that the nvd log is reasonable. Run it twice to get only NVD logs shown.
$ arcana apply --on @localboot
Deploy the Terraform infrastructure
$ vault-login
$ eval "$(get-secrets)"
$ nix run .#tf -- plan # Vanilla Terraform from there.
$ nix run .#tf -- apply
Make changes to DNS via dnscontrol
$ vault-login
$ eval "$(get-secrets)"
$ cd dnscontrol
$ dnscontrol preview # preview the changes without applying them
$ dnscontrol push # apply changes
Troubleshooting
I failed to deploy gerrit01
Our Gerrit source build is known to have some hiccups sometimes, we are always interested in build logs, feel free to attach information in a new issue so we can make it more reliable.
get-secrets fails
Are you a floral-admin ? If not, please get in touch with one of the superadmins.