feat(wpcarro/diogenes): Nixify diogenes's Terraform configuration

TL;DR:
- Define googleCloudVM function to provision NixOS VMs on Google Cloud.
- Consume googleCloudVM in diogenes/default.nix
- Define README.md for basic usage instructions (subject to change).
- Delete diogenes's HCL
- Remove `diogenesSystem` from meta.targets

I'm still having trouble with DNS:
- I need to transfer the Google Domains config to Cloud DNS
- `host billandhiscomputer.com` is NXDOMAIN, so I don't trust my tf DNS config
- This is preventing me from getting SSL certs, which blocks my website, quassel

Change-Id: If315876c96298e83a5953f13b62784d2f65a1024
Reviewed-on: https://cl.tvl.fyi/c/depot/+/4747
Tested-by: BuildkiteCI
Reviewed-by: wpcarro <wpcarro@gmail.com>
Autosubmit: wpcarro <wpcarro@gmail.com>

users/wpcarro/nixos/default.nix

@@ -1,9 +1,8 @@
-{ depot, lib, ... }:
+{ depot, ... }:
 
 let systemFor = sys: (depot.ops.nixos.nixosFor sys).system;
 in {
-  diogenesSystem = systemFor depot.users.wpcarro.nixos.diogenes;
   marcusSystem = systemFor depot.users.wpcarro.nixos.marcus;
 
-  meta.targets = [ "diogenesSystem" "marcusSystem" ];
+  meta.targets = [ "marcusSystem" ];
 }

users/wpcarro/nixos/diogenes/README.md

@@ -0,0 +1,17 @@
+# diogenes
+
+diogenes is a NixOS machine deployed on a Google VM. It hosts
+https://wpcarro.dev.
+
+## Deployment
+
+I manage diogenes's deployment with Terraform. My current workflow looks like
+this (highly subject to change):
+
+```shell
+cd /tmp/terraform # or any directory that hosts terraform state
+outpath=$(nix-build /depot -A users.wpcarro.nixos.diogenes)
+cp <out-path> .
+nix-shell -p terraform google-cloud-sdk # gcloud to authenticate if necessary
+terraform init/apply
+```

users/wpcarro/nixos/diogenes/default.nix

@@ -1,31 +1,57 @@
 { depot, pkgs, ... }:
-{ ... }:
 
 let
   inherit (depot.users) wpcarro;
-in {
+  name = "diogenes";
+  domainName = "billandhiscomputer.com";
+in wpcarro.terraform.googleCloudVM {
+  project = "wpcarros-infrastructure";
+  name = "diogenes";
+  region = "us-central1";
+  zone = "us-central1-a";
+
+  # DNS configuration
+  extraConfig = {
+    resource.google_dns_managed_zone."${name}" = {
+      inherit name;
+      dns_name = "${domainName}.";
+    };
+
+    resource.google_dns_record_set."${name}" = {
+      name = "${name}.${domainName}.";
+      type = "A";
+      ttl = 300; # 5m
+      managed_zone = "\${google_dns_managed_zone.${name}.name}";
+      rrdatas = ["\${google_compute_instance.${name}.network_interface[0].access_config[0].nat_ip}"];
+    };
+  };
+
+  configuration = {
     imports = [
       "${depot.path}/ops/modules/quassel.nix"
-    (pkgs.path + "/nixos/modules/virtualisation/google-compute-image.nix")
     ];
 
     networking = {
-    hostName = "diogenes";
+      firewall.allowedTCPPorts = [
-    firewall.enable = false;
+        22   # ssh
+        80   # http
+        443  # https
+        6698 # quassel
+      ];
+      firewall.allowedUDPPortRanges = [
+        { from = 60000; to = 61000; } # mosh
+      ];
     };
 
     # Use the TVL binary cache
     tvl.cache.enable = true;
 
-  # Use 100G volume for /nix
-  fileSystems."/nix" = {
-    device = "/dev/disk/by-uuid/62396bde-9002-4025-83eb-2a6c731b7adc";
-    fsType = "ext4";
-  };
-
     users = {
       mutableUsers = true;
       users = {
+        root = {
+          openssh.authorizedKeys.keys = wpcarro.keys.all;
+        };
         wpcarro = {
           isNormalUser = true;
           extraGroups = [ "wheel" "quassel" ];
@@ -49,8 +75,8 @@ in {
     };
 
     # I won't have an Emacs server running on diogenes, and I'll likely be in an
-  # SSH session from within vterm. As such, Vim is one of the few editors that I
+    # SSH session from within vterm. As such, Vim is one of the few editors that
-  # tolerably navigate this way.
+    # I tolerably navigate this way.
     environment.variables = {
       EDITOR = "vim";
     };
@@ -58,62 +84,67 @@ in {
     environment.systemPackages = wpcarro.common.shell-utils;
 
     services = wpcarro.common.services // {
-    depot.quassel = {
+      # TODO(wpcarro): Re-enable this when rebuild-system better supports
-      enable = true;
+      # terraform deployments.
-      acmeHost = "wpcarro.dev";
+      # depot.auto-deploy = {
-      bindAddresses = [
+      #   enable = true;
-        "0.0.0.0"
+      #   interval = "1h";
-      ];
+      # };
-    };
 
-    depot.auto-deploy = {
+      # TODO(wpcarro): Re-enable this after debugging ACME and NXDOMAIN.
-      enable = true;
+      # depot.quassel = {
-      interval = "1h";
+      #   enable = true;
-    };
+      #   acmeHost = domainName;
-
+      #   bindAddresses = [
-    journaldriver = {
+      #     "0.0.0.0"
-      enable = true;
+      #   ];
-      logStream = "home";
+      # };
-      googleCloudProject = "wpcarros-infrastructure";
+      #
-      applicationCredentials = "/etc/gcp/key.json";
+      # journaldriver = {
-    };
+      #   enable = true;
-
+      #   logStream = "home";
-    nginx = {
+      #   googleCloudProject = "wpcarros-infrastructure";
-      enable = true;
+      #   applicationCredentials = "/etc/gcp/key.json";
-      enableReload = true;
+      # };
-
+      #
-      recommendedTlsSettings = true;
+      #
-      recommendedGzipSettings = true;
+      # nginx = {
-      recommendedProxySettings = true;
+      #   enable = true;
-
+      #   enableReload = true;
-      # for journaldriver
+      #
-      commonHttpConfig = ''
+      #   recommendedTlsSettings = true;
-        log_format json_combined escape=json
+      #   recommendedGzipSettings = true;
-        '{'
+      #   recommendedProxySettings = true;
-            '"remote_addr":"$remote_addr",'
+      #
-            '"method":"$request_method",'
+      #   # for journaldriver
-            '"host":"$host",'
+      #   commonHttpConfig = ''
-            '"uri":"$request_uri",'
+      #     log_format json_combined escape=json
-            '"status":$status,'
+      #     '{'
-            '"request_size":$request_length,'
+      #         '"remote_addr":"$remote_addr",'
-            '"response_size":$body_bytes_sent,'
+      #         '"method":"$request_method",'
-            '"response_time":$request_time,'
+      #         '"host":"$host",'
-            '"referrer":"$http_referer",'
+      #         '"uri":"$request_uri",'
-            '"user_agent":"$http_user_agent"'
+      #         '"status":$status,'
-        '}';
+      #         '"request_size":$request_length,'
-
+      #         '"response_size":$body_bytes_sent,'
-        access_log syslog:server=unix:/dev/log,nohostname json_combined;
+      #         '"response_time":$request_time,'
-      '';
+      #         '"referrer":"$http_referer",'
-
+      #         '"user_agent":"$http_user_agent"'
-      virtualHosts = {
+      #     '}';
-        "wpcarro.dev" = {
+      #
-          addSSL = true;
+      #     access_log syslog:server=unix:/dev/log,nohostname json_combined;
-          enableACME = true;
+      #   '';
-          root = wpcarro.website.root;
+      #
-        };
+      #   virtualHosts = {
-      };
+      #     "${domainName}" = {
-    };
+      #       addSSL = true;
+      #       enableACME = true;
+      #       root = wpcarro.website.root;
+      #     };
+      #   };
+      # };
     };
 
     system.stateVersion = "21.11";
+  };
 }

users/wpcarro/terraform/default.nix

@@ -0,0 +1,185 @@
+{ depot, pkgs, lib, ... }:
+
+let
+  inherit (builtins) concatLists concatStringsSep toJSON unsafeDiscardStringContext;
+  inherit (depot.users) wpcarro;
+  inherit (pkgs) writeText;
+
+  images = import "${pkgs.path}/nixos/modules/virtualisation/gce-images.nix";
+  nixosImage = images."20.09";
+in {
+  googleCloudVM = {
+    project,
+    name,
+    region,
+    zone,
+    configuration,
+    extraConfig ? {},
+  }: let
+    inherit (configuration.users.users) root;
+    inherit (configuration.networking) firewall;
+
+    # Convert NixOS-style port numbers to Terraform-style.
+    asStrings = xs: map toString xs;
+    asRanges = xs: map (x: "${toString x.from}-${toString x.to}") xs;
+
+    sshKeys = concatStringsSep "\n"
+      (map (key: "root:${key}") root.openssh.authorizedKeys.keys);
+
+    os = depot.ops.nixos.nixosFor (_: {
+      imports = [
+        "${pkgs.path}/nixos/modules/virtualisation/google-compute-image.nix"
+        configuration
+      ];
+
+      networking.hostName = name;
+
+      fileSystems."/nix" = {
+        device = "/dev/disk/by-label/google-${name}-disk";
+        fsType = "ext4";
+      };
+    });
+
+    osRoot = os.config.system.build.toplevel;
+    osPath = unsafeDiscardStringContext (toString osRoot.outPath);
+    drvPath = unsafeDiscardStringContext (toString osRoot.drvPath);
+  in writeText "terraform.tf.json" (toJSON (lib.recursiveUpdate extraConfig {
+    provider.google = {
+      inherit project region zone;
+    };
+
+    resource.google_compute_instance."${name}" = {
+      inherit name zone;
+      machine_type = "e2-standard-2";
+  
+      tags = [
+        "http-server"
+        "https-server"
+        "${name}-firewall"
+      ];
+  
+      boot_disk = {
+        device_name = "boot";
+        initialize_params = {
+          size = 10;
+          image = "projects/nixos-cloud/global/images/${nixosImage.name}";
+        };
+      };
+  
+      attached_disk = {
+        source = "\${google_compute_disk.${name}.id}";
+        device_name = "${name}-disk";
+      };
+  
+      network_interface = {
+        network = "default";
+        subnetwork = "default";
+        access_config = {};
+      };
+  
+      # Copy root's SSH keys from the NixOS configuration and expose them to the
+      # metadata server.
+      metadata = {
+        inherit sshKeys;
+        ssh-keys = sshKeys;
+
+        # NixOS's fetch-instance-ssh-keys.bash relies on these fields being
+        # available on the metadata server.
+        ssh_host_ed25519_key = "\${tls_private_key.${name}.private_key_pem}";
+        ssh_host_ed25519_key_pub = "\${tls_private_key.${name}.public_key_pem}";
+
+        # Even though we have SSH access, having oslogin can still be useful for
+        # troubleshooting in the browser if for some reason SSH isn't working as
+        # expected.
+        enable-oslogin = "TRUE";
+      };
+  
+      service_account.scopes = ["cloud-platform"];
+    };
+
+    resource.tls_private_key."${name}" = {
+      algorithm = "ECDSA";
+      ecdsa_curve = "P384";
+    };
+
+    resource.google_compute_firewall."${name}" = {
+      name = "${name}-firewall";
+      network = "default";
+
+      # Read the firewall configuration from the NixOS configuration.
+      allow = [
+        {
+          protocol = "tcp";
+          ports = concatLists [
+            (asStrings (firewall.allowedTCPPorts or []))
+            (asRanges (firewall.allowedTCPPortRanges or []))
+          ];
+        }
+        {
+          protocol = "udp";
+          ports = concatLists [
+            (asStrings (firewall.allowedUDPPorts or []))
+            (asRanges (firewall.allowedUDPPortRanges or []))
+          ];
+        }
+      ];
+      source_tags = ["${name}-firewall"];
+    };
+  
+    resource.google_compute_disk."${name}" = {
+      inherit zone;
+      name = "${name}-disk";
+      size = 100;
+    };
+
+    resource.null_resource.deploy_nixos = {
+      triggers = {
+        # Redeploy when the NixOS configuration changes.
+        os = "${osPath}";
+        # Redeploy when a new machine is provisioned.
+        machine_id = "\${google_compute_instance.${name}.id}";
+      };
+
+      connection = {
+        host = "\${google_compute_instance.${name}.network_interface[0].access_config[0].nat_ip}";
+      };
+
+      provisioner = [
+        { remote-exec.inline = ["true"]; }
+        {
+          local-exec.command = ''
+            export PATH="${pkgs.openssh}/bin:$PATH"
+
+            scratch="$(mktemp -d)"
+            function cleanup() {
+              rm -rf $scratch
+            }
+            trap cleanup EXIT
+
+            # write out ssh key
+            echo -n "''${tls_private_key.${name}.private_key_pem}" > $scratch/id_rsa.pem
+            chmod 0600 $scratch/id_rsa.pem
+
+            export NIX_SSHOPTS="\
+              -o StrictHostKeyChecking=no\
+              -o UserKnownHostsFile=/dev/null\
+              -o GlobalKnownHostsFile=/dev/null\
+              -o IdentityFile=$scratch/id_rsa.pem
+            "
+
+            nix-build ${drvPath}
+            nix-copy-closure --to \
+              root@''${google_compute_instance.${name}.network_interface[0].access_config[0].nat_ip} \
+              ${osPath} --gzip --use-substitutes
+          '';
+        }
+        {
+          remote-exec.inline = [
+            "nix-env --profile /nix/var/nix/profiles/system --set ${osPath}"
+            "${osPath}/bin/switch-to-configuration switch"
+          ];
+        }
+      ];
+    };
+  }));
+}

users/wpcarro/terraform/gcp.tf

@@ -1,79 +0,0 @@
-provider "google" {
-  project = "wpcarros-infrastructure"
-  region  = "us-central1"
-  zone    = "us-central1-a"
-}
-
-data "google_compute_default_service_account" "default" {}
-
-resource "google_compute_instance" "default" {
-  name         = "diogenes-2"
-  machine_type = "e2-standard-2"
-  zone         = "us-central1-a"
-  hostname     = "diogenes.wpcarro.dev"
-
-  tags = [
-    "http-server",
-    "https-server",
-    "diogenes-firewall"
-  ]
-
-  boot_disk {
-    device_name = "boot"
-
-    initialize_params {
-      size  = 10
-      image = "projects/nixos-cloud/global/images/nixos-image-20-09-3531-3858fbc08e6-x86-64-linux"
-    }
-  }
-
-  attached_disk {
-    source      = "diogenes-2-disk"
-    device_name = "diogenes-2-disk"
-  }
-
-  network_interface {
-    network    = "default"
-    subnetwork = "default"
-
-    access_config {}
-  }
-
-  metadata = {
-    # sshKeys is deprecated, but the GCE NixOS image relies on it, so we need
-    # both values:
-    # - deprecation: https://cloud.google.com/compute/docs/metadata/default-metadata-values
-    # - NixOS bug: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/virtualisation/fetch-instance-ssh-keys.bash#L14
-    ssh-keys = "wpcarro:ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJkNQJBXekuSzZJ8+gxT+V1+eXTm3hYsfigllr/ARXkf wpcarro@gmail.com"
-    sshKeys  = "wpcarro:ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJkNQJBXekuSzZJ8+gxT+V1+eXTm3hYsfigllr/ARXkf wpcarro@gmail.com"
-  }
-
-  service_account {
-    scopes = ["cloud-platform"]
-  }
-}
-
-resource "google_compute_firewall" "default" {
-  name    = "diogenes-firewall"
-  network = "default"
-
-  allow {
-    protocol = "tcp"
-    ports    = ["6698"]
-  }
-
-  allow {
-    protocol = "udp"
-    ports = [
-      "60000-61000" # mosh
-    ]
-  }
-
-  source_tags = ["diogenes-firewall"]
-}
-
-resource "google_compute_disk" "default" {
-  name = "diogenes-2-disk"
-  zone = "us-central1-a"
-  size = 100
-}