Page MenuHomeDevCentral
Files F49007841

D4207.id11033.diff
No OneTemporary
Actions

D4207.id11033.diff
View Options

diff --git a/roles/devserver/userland-software/init.sls b/roles/devserver/userland-software/init.sls
--- a/roles/devserver/userland-software/init.sls
+++ b/roles/devserver/userland-software/init.sls
@@ -21,6 +21,7 @@
- .dev
- .misc
- .notifications
+ - .pefs
- .phabricator
- .psysh
- .tex
diff --git a/roles/devserver/userland-software/misc.sls b/roles/devserver/userland-software/misc.sls
--- a/roles/devserver/userland-software/misc.sls
+++ b/roles/devserver/userland-software/misc.sls
@@ -93,23 +93,6 @@
/etc/make.conf:
file.managed:
- source: salt://roles/devserver/userland-software/files/make.conf
-
-freebsd_kernel_modules:
- pkg.installed:
- - pkgs:
- - pefs-kmod
-
-freebsd_kernel_modules_enable:
- module.wait:
- - name: kmod.load
- - mod: pefs
- - persist: True
- - watch:
- - pkg: freebsd_kernel_modules
-
-/boot/loader.conf.d/pefs.conf:
- file.managed:
- - source: salt://roles/devserver/userland-software/files/pefs.conf
{% endif %}
devserver_software_misc_p2p:
diff --git a/roles/devserver/userland-software/pefs.sls b/roles/devserver/userland-software/pefs.sls
new file mode 100644
--- /dev/null
+++ b/roles/devserver/userland-software/pefs.sls
@@ -0,0 +1,25 @@
+# -------------------------------------------------------------
+# Salt — PEFS
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+# Project: Nasqueron
+# License: Trivial work, not eligible to copyright
+# -------------------------------------------------------------
+
+{% if grains["os"] == "FreeBSD" %}
+
+pefs-kmod:
+ pkg.installed
+
+pefs_kernel_modules_enable:
+ module.wait:
+ - name: kmod.load
+ - mod: pefs
+ - persist: True
+ - watch:
+ - pkg: pefs-kmod
+
+/boot/loader.conf.d/pefs.conf:
+ file.managed:
+ - source: salt://roles/devserver/userland-software/files/pefs.conf
+
+{% endif %}
diff --git a/roles/devserver/userland-software/files/port_options b/roles/devserver/userland-software/port_options
rename from roles/devserver/userland-software/files/port_options
rename to roles/devserver/userland-software/port_options
diff --git a/roles/salt-primary/opentofu/config.sls b/roles/salt-primary/opentofu/config.sls
new file mode 100644
--- /dev/null
+++ b/roles/salt-primary/opentofu/config.sls
@@ -0,0 +1,36 @@
+# -------------------------------------------------------------
+# Salt — Provision a salt primary server
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+# Project: Nasqueron
+# License: Trivial work, not eligible to copyright
+# -------------------------------------------------------------
+
+# -------------------------------------------------------------
+# Terraform / OpenTofu encrypted working directory
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+/opt/terraform:
+ file.directory:
+ - user: deploy
+ - group: ops
+ - mode: 770
+
+/opt/terraform.enc:
+ file.directory:
+ - user: deploy
+ - group: ops
+ - mode: 770
+
+# -------------------------------------------------------------
+# Wrapper for tofu/terraform/pefs commands
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+/usr/local/bin/initialize-pefs:
+ file.managed:
+ - source: salt://roles/salt-primary/opentofu/files/initialize-pefs.sh
+ - mode: 755
+
+/usr/local/bin/tf:
+ file.managed:
+ - source: salt://roles/salt-primary/opentofu/files/tf.sh
+ - mode: 755
diff --git a/roles/salt-primary/opentofu/files/initialize-pefs.sh b/roles/salt-primary/opentofu/files/initialize-pefs.sh
new file mode 100644
--- /dev/null
+++ b/roles/salt-primary/opentofu/files/initialize-pefs.sh
@@ -0,0 +1,63 @@
+#!/bin/sh
+
+# -------------------------------------------------------------
+# Initialize PEFS
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+# Project: Nasqueron
+# License: BSD-2-Clause
+# Description: Set password for Terraform / OpenTofu PEFS
+# Usage: initialize-pefs ops/infra/complector/terraform/pefs /opt/terraform.enc /opt/terraform
+# Source file: roles/salt-primary/opentofu/files/initialize-pefs.sh
+# -------------------------------------------------------------
+#
+# <auto-generated>
+# This file is managed by our rOPS SaltStack repository.
+#
+# Changes to this file may cause incorrect behavior
+# and will be lost if the state is redeployed.
+# </auto-generated>
+
+set -e
+
+# -------------------------------------------------------------
+# Parse arguments
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+if [ $# -lt 3 ]; then
+ echo "Usage: $(basename "$0") <Vault key path> <encrypted filesystem> <mount point>" >&2
+ exit 1
+fi
+
+VAULT_PATH=$1
+PEFS_ENC=$2
+PEFS_MOUNT=$3
+
+# -------------------------------------------------------------
+# Mount filesystem
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+if ! pefs mount "$PEFS_ENC" "$PEFS_MOUNT"; then
+ echo "Error: Failed to mount PEFS" >&2
+ exit 2
+fi
+
+# -------------------------------------------------------------
+# Ensure unmount PEFS on exit
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+unmount_pefs() {
+ pefs umount "$PEFS_MOUNT" 2>/dev/null || true
+}
+
+trap unmount_pefs EXIT
+
+if [ -f "$PEFS_MOUNT/.pefs.db" ]; then
+ echo "That directory has already been initialized."
+ exit 4
+fi
+
+# -------------------------------------------------------------
+# Add a new chain element
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+vault kv get -field=password "$VAULT_PATH" | pefs addchain -fZ -j - "$PEFS_MOUNT"
diff --git a/roles/salt-primary/opentofu/files/tf.sh b/roles/salt-primary/opentofu/files/tf.sh
new file mode 100644
--- /dev/null
+++ b/roles/salt-primary/opentofu/files/tf.sh
@@ -0,0 +1,128 @@
+#!/bin/sh
+
+# -------------------------------------------------------------
+# Wrapper to securely manage Terraform state on PEFS
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+# Project: Nasqueron
+# Usage: tf <init|plan|apply|state|...> ...
+# License: BSD-2-Clause
+# Source file: roles/salt-primary/opentofu/files/tf.sh
+# -------------------------------------------------------------
+#
+# <auto-generated>
+# This file is managed by our rOPS SaltStack repository.
+#
+# Changes to this file may cause incorrect behavior
+# and will be lost if the state is redeployed.
+# </auto-generated>
+
+set -e
+
+REPO_TF_BASE="/opt/salt/nasqueron-operations/terraform"
+
+PEFS_ENC="/opt/terraform.enc"
+PEFS_MOUNT="/opt/terraform"
+
+VAULT_PATH="ops/infra/complector/terraform/pefs"
+
+# -------------------------------------------------------------
+# Get working directory
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+CURRENT_DIR="$(pwd)"
+
+case "$CURRENT_DIR" in
+ "${REPO_TF_BASE}"/*)
+ # Remove REPO_TF_BASE/ prefix to get the subdirectory name
+ TF_CONFIG="${CURRENT_DIR#"$REPO_TF_BASE/"}"
+
+ # Ensure it's a single top-level directory (no nested slashes like foo/bar)
+ case "$TF_CONFIG" in
+ */*)
+ echo "Error: You must be in a top-level Terraform subdirectory of $REPO_TF_BASE" >&2
+ echo "Current directory: $CURRENT_DIR" >&2
+ exit 1
+ ;;
+ esac
+ ;;
+ *)
+ echo "Error: Must be run from a subdirectory of $REPO_TF_BASE" >&2
+ echo "Current directory: $CURRENT_DIR" >&2
+ exit 1
+ ;;
+esac
+
+# -------------------------------------------------------------
+# Terraform or OpenTofu?
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+STILL_REQUIRE_TERRAFORM="openbao ovh-ops-backups"
+
+is_terraform_config() {
+ for terraform_subdir in $STILL_REQUIRE_TERRAFORM; do
+ [ "$1" = "$terraform_subdir" ] && return 0
+ done
+ return 1
+}
+
+if is_terraform_config "$TF_CONFIG"; then
+ TF=terraform
+else
+ TF=tofu
+fi
+
+# -------------------------------------------------------------
+# Ensure unmount PEFS on exit
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+MOUNTED_BY_US=0
+
+unmount_pefs() {
+ if [ "$MOUNTED_BY_US" -eq 1 ]; then
+ # Attempt to unmount, suppress errors if already unmounted or busy
+ pefs umount "$PEFS_MOUNT" 2>/dev/null || true
+ fi
+}
+
+# Trap EXIT covers normal completion, script errors (exit 1), and signals (SIGINT/SIGTERM)
+trap unmount_pefs EXIT
+
+# -------------------------------------------------------------
+# Mount and decrypt PEFS
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+if ! mount | grep -q "pefs on ${PEFS_MOUNT} ("; then
+ echo "Mounting PEFS..." >&2
+ if ! pefs mount "$PEFS_ENC" "$PEFS_MOUNT"; then
+ echo "Error: Failed to mount PEFS" >&2
+ exit 2
+ fi
+ MOUNTED_BY_US=1
+fi
+
+if [ -z "$(pefs showkeys "$PEFS_MOUNT" 2>/dev/null)" ]; then
+ echo "Fetching PEFS key from Vault..."
+ if ! vault kv get -field=password "$VAULT_PATH" | pefs addkey -a aes256-xts -c -j - "$PEFS_MOUNT" 2>/dev/null; then
+ echo "Error: Failed to add PEFS key using password from Vault at $VAULT_PATH"
+ exit 1
+ fi
+fi
+
+# -------------------------------------------------------------
+# Ensure Terraform directories exist
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+TF_STATES_DIR="${PEFS_MOUNT}/tf-state/${TF_CONFIG}"
+export TF_DATA_DIR="${PEFS_MOUNT}/tf-data/${TF_CONFIG}"
+
+mkdir -p "$TF_STATES_DIR" "$TF_DATA_DIR"
+
+# -------------------------------------------------------------
+# Call Terraform/OpenTofu
+#
+# Pass all arguments directly to terraform.
+# The script will exit with Terraform's exact exit code,
+# and the trap will unmount PEFS.
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+$TF "$@"
diff --git a/roles/salt-primary/opentofu/init.sls b/roles/salt-primary/opentofu/init.sls
--- a/roles/salt-primary/opentofu/init.sls
+++ b/roles/salt-primary/opentofu/init.sls
@@ -5,11 +5,9 @@
# License: Trivial work, not eligible to copyright
# -------------------------------------------------------------
-opentofu_software:
- pkg.installed:
- - pkgs:
- - opentofu
- - terraform # fallback for providers not compiled for FreeBSD
+include:
+ - .software
+ - roles/devserver/userland-software/pefs
- # Helpers for authentication to Terraform providers
- - ovhcloud-cli
+ # Depends of pefs
+ - .config
diff --git a/roles/salt-primary/opentofu/init.sls b/roles/salt-primary/opentofu/software.sls
copy from roles/salt-primary/opentofu/init.sls
copy to roles/salt-primary/opentofu/software.sls

File Metadata

Mime Type
text/plain
Expires
Thu, Sep 10, 22:16 (18 h, 42 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
4077411
Default Alt Text
D4207.id11033.diff (10 KB)

Event Timeline

Nasqueron DevCentral · If it had been much bigger the moon would have had a core of ice. · Powered by Phabricator