From 86e833f52ad912c38ecf3a27867d37aef8f2bf5a Mon Sep 17 00:00:00 2001 From: Maxine Aubrey Date: Tue, 24 Sep 2024 23:18:50 +0200 Subject: [PATCH] chore(tf): drop all gandi resources --- flake.nix | 1 - terraform/default.nix | 1 - terraform/gandi.nix | 116 ------------------------------------------ 3 files changed, 118 deletions(-) delete mode 100644 terraform/gandi.nix diff --git a/flake.nix b/flake.nix index d2a52df..a3e8bd3 100644 --- a/flake.nix +++ b/flake.nix @@ -68,7 +68,6 @@ ./terraform { bagel.dnsimple.enable = true; - bagel.gandi.enable = true; bagel.hydra.enable = true; } ]; diff --git a/terraform/default.nix b/terraform/default.nix index 95b7df6..f72385b 100644 --- a/terraform/default.nix +++ b/terraform/default.nix @@ -1,7 +1,6 @@ { imports = [ ./common.nix - ./gandi.nix ./dnsimple.nix ./hydra.nix ./state.nix diff --git a/terraform/gandi.nix b/terraform/gandi.nix deleted file mode 100644 index 6ee8e73..0000000 --- a/terraform/gandi.nix +++ /dev/null @@ -1,116 +0,0 @@ -{ lib, config, ... }: -let - inherit (lib) mkEnableOption mkIf tf genList; - cfg = config.bagel.gandi; -in -{ - options.bagel.gandi = { - enable = mkEnableOption "the Gandi DNS configuration"; - }; - - config = mkIf cfg.enable { - terraform.required_providers.gandi = { - version = "~> 2.3.0"; - source = "go-gandi/gandi"; - }; - - resource.secret_resource.gandi_pat.lifecycle.prevent_destroy = true; - - provider.gandi = { - personal_access_token = tf.ref "resource.secret_resource.gandi_pat.value"; - }; - - resource.gandi_livedns_domain.forkos_org = { - name = "forkos.org"; - }; - - resource.gandi_livedns_record = let - record = name: ttl: type: values: { - inherit name ttl type values; - }; - - proxyRecords = name: ttl: type: values: [ - # kurisu.lahfa.xyz running a sniproxy: - (record name ttl "A" ["163.172.69.160"]) - (record name ttl type values) - ]; - - # Creates a extra *.p record pointing to the sniproxy - dualProxyRecords = name: ttl: type: values: lib.flatten [ - (record name ttl type values) - (proxyRecords "${name}.p" ttl type values) - ]; - - # TODO: make less fragile and have actual unique and stable names - canonicalName = record: let - name = builtins.replaceStrings ["." "@"] ["_" "_root_"] record.name; - in - "forkos_org_${record.type}_${name}"; - - forkosRecords = records: - builtins.listToAttrs (map (record: { - name = canonicalName record; - value = record // { - zone = tf.ref "resource.gandi_livedns_domain.forkos_org.id"; - }; - }) (lib.flatten records)); - - in forkosRecords ([ - # (record "@" 300 "A" ["163.172.69.160"]) - (record "@" 300 "AAAA" ["2001:bc8:38ee:100:1000::20"]) - - (dualProxyRecords "bagel-box.infra" 300 "AAAA" ["2001:bc8:38ee:100:100::1"]) - (dualProxyRecords "gerrit01.infra" 300 "AAAA" ["2001:bc8:38ee:100:1000::10"]) - (dualProxyRecords "meta01.infra" 300 "AAAA" ["2001:bc8:38ee:100:1000::20"]) - (dualProxyRecords "fodwatch.infra" 300 "AAAA" ["2001:bc8:38ee:100:1000::30"]) - # git.infra.forkos.org exposes opensshd - (dualProxyRecords "git.infra" 300 "AAAA" ["2001:bc8:38ee:100:1000::41"]) - # git.p.forkos.org exposes forgejo ssh server. - (proxyRecords "git.p" 300 "AAAA" ["2001:bc8:38ee:100:1000::40"]) - (dualProxyRecords "buildbot.infra" 300 "AAAA" ["2001:bc8:38ee:100:1000::50"]) - (dualProxyRecords "public01.infra" 300 "AAAA" ["2001:bc8:38ee:100:1000::60"]) - - (record "cl" 300 "CNAME" ["gerrit01.infra.p"]) - (record "fodwatch" 300 "CNAME" ["fodwatch.infra.p"]) - # git.p.forkos.org is the proxy variant of the Forgejo server. - (record "git" 300 "CNAME" ["git.p"]) - (record "netbox" 300 "CNAME" ["meta01.infra.p"]) - (record "amqp" 300 "CNAME" ["bagel-box.infra.p"]) - (record "grafana" 300 "CNAME" ["meta01.infra.p"]) - (record "hydra" 300 "CNAME" ["build-coord.wob01.infra.p"]) - (record "loki" 300 "CNAME" ["meta01.infra.p"]) - (record "mimir" 300 "CNAME" ["meta01.infra.p"]) - (record "pyroscope" 300 "CNAME" ["meta01.infra.p"]) - (record "tempo" 300 "CNAME" ["meta01.infra.p"]) - (record "matrix" 300 "CNAME" ["meta01.infra.p"]) - (record "alerts" 300 "CNAME" ["meta01.infra.p"]) - (record "buildbot" 300 "CNAME" ["buildbot.infra.p"]) - (record "b" 300 "CNAME" ["public01.infra.p"]) - (record "postgres" 300 "CNAME" ["bagel-box.infra.p"]) - (record "news" 3600 "CNAME" ["public01.infra.p"]) - (record "status" 3600 "CNAME" ["public01.infra.p"]) - - # S3 in delroth's basement - (record "cache" 300 "AAAA" ["2a02:168:6426::12"]) # smol.delroth.net - (record "cache" 300 "A" ["195.39.247.161"]) # sni proxy - - (record "vpn-gw.wob01.infra" 300 "AAAA" [ "2a01:584:11::2" ]) - - (dualProxyRecords "build-coord.wob01.infra" 300 "AAAA" [ "2a01:584:11::1:11" ]) - # TODO: do not hardcode, just reuse the Colmena hive module outputs to generate all the required details. - ] - ++ (map (index: record "builder-${toString index}.wob01.infra" 300 "AAAA" [ "2a01:584:11::1:${toString index}" ]) (genList lib.id 11)) - ++ ( - let - # FIXME: figure out a way to poke `config.services.s3-revproxy` and - # automate the DNS part away? - buckets = [ - "channels" - "releases" - "channel-scripts-test" - ]; - in - map (bucket: record "${bucket}" 300 "CNAME" [ "public01.infra.p" ]) buckets - )); - }; -}