4c7150d502
Adds terraform/ (hcloud provider, cpx32/nbg1/debian-12) and a new nix/hosts/cc-ci-hetzner/ flake host to provision the cc-ci server on Hetzner Cloud as an alternative to the Incus cc-nix-test VM. Stage 1 (Terraform): creates a cpx32 server (4 vCPU / 8 GB / x86 AMD, Nuremberg), runs nixos-infect (pinned rev 40f62a6, 2026-03-22) to convert Debian 12 → NixOS 24.11, and reboots into bare NixOS. Stage 2 (manual, per terraform/README.md): clone cc-ci --recursive, provision the bootstrap age key, then `nixos-rebuild switch --flake .#cc-ci-hetzner`. Verified (throwaway run 2026-05-31, server 134464512, 168.119.126.100): - terraform apply: cpx32 in nbg1 created in 17 s - nixos-infect: NixOS 24.11.719113.50ab793786d9 (same nixpkgs pin as flake) - nixos-rebuild build --flake .#cc-ci-hetzner: exit 0 on server (131 derivations; all cc-ci modules: tailscale, drone, drone-runner, bridge, dashboard, harness, swarm, abra, proxy, secrets) - terraform plan: no changes (idempotent) - terraform destroy: server + SSH key removed Age key step (plan §4 Stage 2): operator-pending. Full switch/convergence requires bootstrap age key at /var/lib/sops-nix/key.txt. Flake builds without it; activation needs it. No secrets committed: HCLOUD_TOKEN via env, tfstate gitignored, networking.nix contains throwaway IP (update per README for production). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
69 lines
2.2 KiB
Nix
69 lines
2.2 KiB
Nix
# cc-ci on Hetzner Cloud — NixOS configuration.
|
|
# Extends the shared cc-ci modules (same services as the Incus host) with
|
|
# Hetzner-specific hardware + networking. Run in parallel with the Incus cc-ci
|
|
# host during transition; make this the canonical cc-ci after cutover (plan §7).
|
|
#
|
|
# To apply after `terraform apply` + nixos-infect:
|
|
# git clone --recursive https://git.autonomic.zone/recipe-maintainers/cc-ci.git /etc/cc-ci
|
|
# install -m600 <age-private-key> /var/lib/sops-nix/key.txt
|
|
# nixos-rebuild switch --flake /etc/cc-ci#cc-ci-hetzner
|
|
{ pkgs, lib, ... }:
|
|
{
|
|
imports = [
|
|
./hardware.nix
|
|
./networking.nix
|
|
../../modules/packages.nix
|
|
../../modules/secrets.nix
|
|
../../modules/swarm.nix
|
|
../../modules/docker-prune.nix
|
|
../../modules/abra.nix
|
|
../../modules/proxy.nix
|
|
../../modules/drone.nix
|
|
../../modules/drone-runner.nix
|
|
../../modules/bridge.nix
|
|
../../modules/dashboard.nix
|
|
../../modules/backupbot.nix
|
|
../../modules/harness.nix
|
|
../../modules/warm-keycloak.nix
|
|
../../modules/nightly-sweep.nix
|
|
];
|
|
|
|
# Timezone (same as Incus host — see configuration.nix there for rationale).
|
|
time.timeZone = "UTC";
|
|
environment.etc."timezone".text = "UTC\n";
|
|
|
|
# Tailscale — keeps the orchestrator→cc-ci access path unchanged (direct peer).
|
|
# On the Hetzner host the auth key is also seeded via /etc/ts-auth-key.
|
|
services.tailscale = {
|
|
enable = true;
|
|
authKeyFile = "/etc/ts-auth-key";
|
|
extraUpFlags = [ "--hostname=cc-ci" ];
|
|
};
|
|
|
|
# SSH — allow root login over tailscale (same as Incus host).
|
|
services.openssh = {
|
|
enable = true;
|
|
settings.PermitRootLogin = "yes";
|
|
};
|
|
|
|
# Firewall — Hetzner has a public IP, so open 80+443 for Traefik.
|
|
# Tailscale interface is trusted (no port restrictions for orchestrator access).
|
|
# Plan §6: v1 keeps the sops wildcard cert; evaluate ACME-on-public-IP as follow-up.
|
|
networking.firewall = {
|
|
enable = true;
|
|
trustedInterfaces = [ "tailscale0" ];
|
|
allowedTCPPorts = [ 22 80 443 ];
|
|
};
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
curl
|
|
git
|
|
jq
|
|
openssh
|
|
];
|
|
|
|
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
|
|
|
system.stateVersion = "24.11";
|
|
}
|