c9aa82ba49
feat(terraform): support declarative subCAs and their Vault policies
...
We can now derive an infinite amount of subCAs as long as we do not
violate extensions constraints.
Additionally, we can build Vault policies specific to the PKI endpoint
without encoding the mountpoints.
Additionally, we can build Vault roles specific to the PKI endpoint
without encoding the mountpoints.
This adds an example of deep-derivation.
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
2025-01-01 01:54:37 +01:00
efeeecb7e2
feat(terraform): support declarative Vault policies
...
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
2024-12-31 20:54:00 +01:00
43ca7c7187
fix: forgotten ../ in the path for the signed ICA1
...
Oopsie, I had in my local tree, merged too fast. I really need CI :'(.
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
2024-12-31 17:56:26 +01:00
8c9c060eb4
feat: enable ICA2 and insert ICA1 in Vault
...
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
2024-12-31 17:50:39 +01:00
4c9c432ab8
chore(terraform/dns): fix the builder CNAMEs
...
They were not pointing to the right thing I think.
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
2024-12-30 18:22:23 +01:00
4eb8adb60c
chore(terraform/dnsimple): upgrade to 1.8.0
...
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
2024-12-30 18:22:02 +01:00
10ffc0684c
feat(terraform/vault/pki): init
...
This initialize a PKI setup that will now require a root initialization
token for the Vault.
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
2024-12-30 17:22:25 +01:00
b541b78145
chore: connect terraform to the hive
...
This way, we can autogenerate records for storage and builders nodes by
reading directly the configuration.
This makes evaluation of `nix run .#tf` slower, but this makes things
more safer and easier, so it's good.
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
2024-12-23 21:30:38 +01:00
9051ce73c6
fix: disable IPv4 on amqp.forkos.org
...
Otherwise, the renew fails all the time!
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
2024-12-15 16:51:45 +01:00
a4d4ff8041
feat(build-coord): enable first Vault instance on it
...
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
2024-12-15 16:30:21 +01:00
86e833f52a
chore(tf): drop all gandi resources
2024-10-05 18:46:45 +02:00
b291caac46
feat(monitoring): add uptime-kuma for status page, fixes #97
...
Adds a service for a status page using
[`uptime-kuma`](https://uptime.kuma.pet/ ).
2024-10-01 16:13:23 +00:00
8d95d1f850
fix(dns): dnsimple expects FQDNs in CNAMEs
...
DNSimple doesn't appear to follow the typical behaviour of appending the
domain unless the CNAME is terminated with `.`
To avoid further problems, let's just explicilty use the FQDN for all
CNAMEs.
https://support.dnsimple.com/articles/cname-record/
For comparison:
```
;; ANSWER SECTION:
alerts.forkos.org. 300 IN CNAME meta01.infra.p.
```
```
;; ANSWER SECTION:
alerts.forkos.org. 181 IN CNAME meta01.infra.p.forkos.org.
meta01.infra.p.forkos.org. 181 IN A 163.172.69.160
```
2024-09-24 23:11:28 +02:00
29c1b366c6
feat(dns): migrate forkos.org zone to dnsimple
2024-09-24 21:10:39 +02:00
16027be2ca
fix(dns): apex cnames are not allowed
...
change flowery.systems from CNAME to ALIAS pointing to news.forkos.org
2024-09-24 20:50:41 +02:00
8acc60e328
feat(dns): migrate functions from gandi to dnsimple
2024-09-24 00:25:58 +02:00
e3b6cb72b4
feat(dns): add dnsimple to terraform configuration
2024-09-23 19:49:21 +02:00
c1712dc1fa
Set up tempo
2024-08-31 15:05:30 +03:00
322f10d9ae
feat(dns): add raw S3 reverse proxies domains for channel scripts
...
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
2024-08-31 00:19:40 +02:00
bf7252c210
terraform/hydra: more nixpkgses now
2024-08-30 21:34:30 +03:00
30d759edf4
terraform/hydra: switch k900-experiments jobset to less-nixpkgses branch
2024-08-30 19:22:09 +03:00
42cfa695ea
dns: add pyroscope.forkos.org → meta01
...
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
2024-08-23 21:03:07 +02:00
58c0dd3d2e
feat(public): add listmonk instance on news.forkos.org
...
To prepare for public communications and updates.
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
2024-08-21 16:45:12 +02:00
a72a991863
add A record for cache.forkos.org
2024-08-19 23:06:46 +02:00
8ffb7e51f1
tf/gandi: reduce all TTLs from 1h to 5m
...
Serving DNS is absurdly cheap (and we don't even do it ourselves right
now), and this makes it easier to iterate on DNS configs.
2024-08-16 08:51:31 +02:00
b7d913b22f
tf/gandi: move hydra CNAME to build-coord
2024-08-16 08:50:35 +02:00
e7f25d6ee2
tf/gandi: add a postgres CNAME to bagel-box
2024-08-16 07:34:55 +02:00
90325344a3
Reserve builder-11 for build coordination, rename to build-coord
2024-08-13 19:12:36 +02:00
ca904d7b4e
tf: use tf.ref instead of config.resource.* when dependencies matter
...
Using config.resource.* gets interpolated by Nix, whereas tf.ref gets
interpolated by Terraform. The latter ends up generating implicit
dependencies between resources.
In practice, the lack of dependencies was only showing up when creating
a new Hydra project + jobset at the same time - the concurrent /
misordered creation sometimes required two different TF applications to
create first the project then the jobset (the first application would
end up with a failure).
2024-08-12 19:36:50 +02:00
9ad279a505
Set up admins + DNS for hookshot
2024-08-09 14:03:56 +00:00
dd81b78f7a
add nixos-main jobset
2024-07-28 23:40:36 +02:00
537b3b978c
remove yureka-staging-test jobset
...
I have no idea how, but it seems I accidentally deleted this jobset
2024-07-28 23:39:57 +02:00
f737c957a5
add staging next jobsets
2024-07-26 21:17:55 +02:00
b8a4cd928d
tf/dns: prepare public01 DNS records
...
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
2024-07-25 20:40:17 +02:00
6ad9e0416d
tf/dns: cache.forkos.org will be born
...
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
2024-07-23 17:28:17 +02:00
555728ca0f
point k900 experiments jobset at nixos/release.nix
2024-07-21 19:41:17 +02:00
60654e45d9
tf/hydra: use that weird commit for testing purpose
...
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
2024-07-21 19:18:42 +02:00
8aa5761660
tf/hydra: add k900 experiment jobset
...
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
2024-07-21 19:16:20 +02:00
d4f8cb6c87
add jobset for yureka-staging-test
2024-07-20 15:14:00 +02:00
87bd42cf1d
tf/dns: pre-add buildbot.forkos.org
...
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
2024-07-17 14:44:18 +02:00
34e8b4b98a
tf/dns: rework the forgejo DNS for the 2 servers
...
git.forkos.org → Forgejo
git.infra.forkos.org → OpenSSH
(with the .p. variants for the IPv4→IPv6 SNI proxies)
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
2024-07-17 14:44:11 +02:00
5a05e44a95
tf/hydra: add a project for our hydra fork
2024-07-17 13:34:10 +02:00
37ec674984
dns: pre-add git.forkos.org
...
Reserved for a Forgejo instances with Emily's optimizations.
Plans: a mirror, code search and will see how it goes!
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
2024-07-16 11:54:09 +02:00
3c2691d9e2
terraform/gandi: introduce proxyRecords and proxy web services
2024-07-14 21:39:42 +03:00
087d17c681
tf/hydra: add a project/jobset for infra machine configurations
2024-07-10 18:52:43 +02:00
0e24c18815
tf/hydra: add a test staging-small nixpkgs jobset
2024-07-10 01:57:12 +02:00
90e54d7292
terraform: add DNS records for VPN-GW & builders
...
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
2024-07-10 00:55:42 +02:00
7f46e5d9a4
services: add ofborg, currently running rabbitmq only
2024-07-08 23:55:11 +02:00
82e074881f
DNS: clean up a bit, add root level record for future Matrix shenanigans
2024-07-08 13:54:15 +03:00
5ebd71e4d5
tf/hydra: change Hydra URL
2024-07-08 00:01:24 +02:00
