Skip to content

Commit 5945452

Browse files
mipmipmipmip
committed
big refactor
1 parent 8b0191b commit 5945452

10 files changed

+202
-1
lines changed

‎instance/ec2.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ resource "aws_instance" "ec2nix_server" {
3333

3434
provisioner "local-exec" {
3535

36-
command = file("${path.module}/script/test-machine-up.sh")
36+
command = file("${path.module}/script/local_exec_test_machine_up.sh")
3737
interpreter = ["bash", "-c"]
3838

3939
environment = {

‎instance/local_exec_deploy_via_ssm.tf‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
resource "null_resource" "nixos_deployment_ssm" {
2+
3+
triggers = {
4+
live_config_path = var.live_config_path
5+
}
6+
7+
provisioner "local-exec" {
8+
9+
command = file("${path.module}/script/local_exec_deploy_via_ssm.sh")
10+
interpreter = ["bash", "-c"]
11+
12+
environment = {
13+
LIVE_CONFIG_PATH = var.live_config_path
14+
NIX_SSHOPTS = "-F ${path.module}/ssh.conf -i ${var.ssh_id_file}"
15+
SSH_ID_FILE = var.ssh_id_file
16+
AWS_ACCOUNT_ID = var.aws_account_id
17+
SCRIPT_PATH = "${path.module}/script"
18+
SSH_CONFIG_FILE = "${path.module}/ssh.conf"
19+
TARGET = var.associate_public_ip_address ? "root@${aws_instance.ec2nix_server.public_ip}" : "root@${aws_instance.ec2nix_server.id}"
20+
}
21+
}
22+
}

‎instance/local_exec_upload_ssh_workloads_key.tf‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
resource "null_resource" "upload_ssh_workloads_key" {
2+
triggers = {
3+
live_config_path = var.live_config_path
4+
}
5+
6+
provisioner "local-exec" {
7+
command = file("${path.module}/script/local_exec_upload_ssh_workloads_key.sh")
8+
interpreter = ["bash", "-c"]
9+
environment = {
10+
NIX_SSHOPTS = "-F ${path.module}/ssh.conf -i ${var.ssh_id_file}"
11+
AWS_ACCOUNT_ID = var.aws_account_id
12+
SCRIPT_PATH = "${path.module}/script"
13+
SSH_ID_FILE = var.ssh_id_file
14+
SSH_CONFIG_FILE = "${path.module}/ssh.conf"
15+
TARGET = var.associate_public_ip_address ? "root@${aws_instance.ec2nix_server.public_ip}" : "root@${aws_instance.ec2nix_server.id}"
16+
}
17+
}
18+
}

‎instance/script/find_profile.sh‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#!/usr/bin/env bash
2+
3+
# Script to find AWS profile by account ID
4+
# Usage: ./find_profile.sh ACCOUNT_ID
5+
6+
if [ -z "$1" ]; then
7+
echo "Please provide an account ID"
8+
echo "Usage: ./find_profile.sh ACCOUNT_ID"
9+
exit 1
10+
fi
11+
12+
ACCOUNT_ID="$1"
13+
jsonify-aws-dotfiles | jq -r '.config | to_entries[] | select(.value.role_arn != null) | select(.value.role_arn | contains("'"$ACCOUNT_ID"'")) | .key'

‎instance/script/local_exec_deploy_via_ssm.sh‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
#!/usr/bin/env bash
2+
3+
echo $TARGET >> /tmp/debug-target.txt
4+
5+
AWS_PROFILE=$($SCRIPT_PATH/find_profile.sh $AWS_ACCOUNT_ID)
6+
echo $AWS_PROFILE >> /tmp/debug-target.txt
7+
8+
# TODO replace unset SSH_AUTH_SOCK with -o IdentitiesOnly=yes
9+
unset SSH_AUTH_SOCK
10+
11+
echo
12+
echo "UPDATE KNOWN HOSTS"
13+
ssh-keygen -R $(echo $TARGET | sed "s/root@//")
14+
15+
echo
16+
echo "NIX-COPY-CLOSURE"
17+
nix-copy-closure $TARGET $LIVE_CONFIG_PATH
18+
19+
echo
20+
echo "NIX SWITCH TO NEW CONFIG"
21+
ssh -F $SSH_CONFIG_FILE -i $SSH_ID_FILE -oStrictHostKeyChecking=no $TARGET "$LIVE_CONFIG_PATH/bin/switch-to-configuration switch"
22+
23+
# TODO MAKE OPTIONAL
24+
echo
25+
echo "NIX GARBAGE COLLECT"
26+
ssh -F $SSH_CONFIG_FILE -i $SSH_ID_FILE -oStrictHostKeyChecking=no $TARGET 'nix-collect-garbage'
27+

‎instance/script/local_exec_test_machine_up.sh‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
#!/usr/bin/env bash
2+
3+
set -e
4+
test -n "$INSTANCE_ID" || (echo missing INSTANCE_ID; exit 1)
5+
test -n "$SSH_ID_FILE" || (echo missing SSH_ID_FILE; exit 1)
6+
test -n "$SSH_CONFIG_FILE" || (echo missing SSH_CONFIG_FILE; exit 1)
7+
set +e
8+
9+
AWS_PROFILE=$($SCRIPT_PATH/find_profile.sh $AWS_ACCOUNT_ID)
10+
echo $AWS_PROFILE >> /tmp/debug-target.txt
11+
12+
cleanup() {
13+
exit $!
14+
}
15+
16+
for try in {0..100}; do
17+
echo "Polling for machine to come up. Retry #$try"
18+
unset SSH_AUTH_SOCK
19+
20+
if [[ -z "${PUBLIC_IP}" ]]; then
21+
ssh -F $SSH_CONFIG_FILE -i "$SSH_ID_FILE" -oStrictHostKeyChecking=no "root@$INSTANCE_ID" uptime
22+
else
23+
### TODO MAKE CONFIG SWITCH OR ALWAYS USE SSM
24+
ssh -F $SSH_CONFIG_FILE -i "$SSH_ID_FILE" -oStrictHostKeyChecking=no "root@$INSTANCE_ID" uptime
25+
#ssh -i "$SSH_ID_FILE" -oStrictHostKeyChecking=no "root@$PUBLIC_IP" uptime
26+
fi
27+
28+
success="$?"
29+
if [ "$success" -eq 0 ]; then
30+
echo "Machine ${INSTANCE_ID} up and ready to for provisioning over SSM/SSH"
31+
echo ""
32+
echo "Add the the systems private key to agenix and run rekey (agenix -r -i PRIVATE_KEY)"
33+
cat /etc/ssh/ssh_host_ed25519_key.pub
34+
echo
35+
cleanup 0
36+
fi
37+
sleep 5s
38+
done
39+
40+
echo "Failed to poll for machine up status"
41+
cleanup 1

‎instance/script/local_exec_upload_ssh_workloads_key.sh‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#!/usr/bin/env bash
2+
3+
4+
echo
5+
echo "UPDATE KNOWN HOSTS"
6+
ssh-keygen -R $(echo $TARGET | sed "s/root@//")
7+
8+
export AWS_PROFILE=$($SCRIPT_PATH/find_profile.sh $AWS_ACCOUNT_ID)
9+
10+
# TODO only if debug=true
11+
echo $AWS_PROFILE >> /tmp/debug-target.txt
12+
echo $TARGET >> /tmp/debug-target.txt
13+
14+
# TODO replace unset SSH_AUTH_SOCK with -o IdentitiesOnly=yes
15+
unset SSH_AUTH_SOCK
16+
17+
CURR_DIR=$(pwd)
18+
echo $CURR_DIR
19+
20+
cd secrets
21+
SYS_SSH_KEY=$(agenix -d system_sshd_key.age --identity $SSH_ID_FILE)
22+
cd $CURR_DIR
23+
24+
echo $SYS_SSH_KEY | ssh -F $SSH_CONFIG_FILE -oStrictHostKeyChecking=no -i $SSH_ID_FILE \
25+
$TARGET 'cat - > /tmp/system_sshd_key && chmod 600 /tmp/system_sshd_key && chown root:root /tmp/system_sshd_key'

‎instance/security_group.tf‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
resource "aws_security_group" "ec2nix_security_group" {
2+
3+
vpc_id = var.vpc_id
4+
5+
ingress {
6+
from_port = 22
7+
to_port = 22
8+
protocol = "tcp"
9+
cidr_blocks = ["0.0.0.0/0"]
10+
}
11+
12+
dynamic "ingress" {
13+
for_each = var.ingress_ports
14+
15+
content {
16+
from_port = ingress.value
17+
to_port = ingress.value
18+
protocol = "tcp"
19+
cidr_blocks = ["0.0.0.0/0"]
20+
}
21+
}
22+
23+
dynamic "ingress" {
24+
for_each = var.ingress_from_to_ports
25+
26+
content {
27+
from_port = ingress.value.from
28+
to_port = ingress.value.to
29+
protocol = "tcp"
30+
cidr_blocks = ["0.0.0.0/0"]
31+
}
32+
}
33+
34+
## FOR SSM BE SURE 443 is open
35+
egress {
36+
from_port = 0
37+
to_port = 0
38+
protocol = "-1"
39+
cidr_blocks = ["0.0.0.0/0"]
40+
}
41+
}

‎instance/ssh.conf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# vim: set ft=sshconfig:
2+
3+
# SSH over Session Manager
4+
host i-* mi-*
5+
StrictHostKeyChecking no
6+
UserKnownHostsFile=/dev/null
7+
CheckHostIP=no
8+
ProxyCommand sh -c "aws ssm start-session --region eu-central-1 --target %h --document-name AWS-StartSSHSession --parameters 'portNumber=%p'"

‎instance/volume_attachment.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
resource "aws_volume_attachment" "ec2nix_server_vol" {
2+
count = var.ebs_volume_id != "" ? 1 : 0
3+
device_name = "/dev/xvdb"
4+
volume_id = var.ebs_volume_id
5+
instance_id = aws_instance.ec2nix_server.id
6+
}

0 commit comments

Comments
 (0)