infra

gaslightCTF infrastructure as code. Extremely overengineered (<3 Nix)

Manages the following resources:

• terranix/
  • GCE network, subnet, firewall
    • GCE subnet, firewall
    • GCE network LB
  • GCE instances
  • Cloudflare DNS records
    • play[-dev]. -> network-lb
    • chall[-dev]. -> network-lb
• nixos/
  • NixOS config for k3s nodes
  • monitoring
    • logs go somewhere
    • metrics go somewhere
• nixidy/
  • storage
    • CSI GCE PD driver
  • cilium config
  • Traefik config
    • cert-manager
  • berg deployment
  • argocd config

adding a new host

• add instances.[name].enable = true to ./terranix/infra/default.nix
  • tofu-dev apply
• add a ./secrets/dev/[name].yaml
• update ./data/ips.nix
• just sync dev

terranix

tofu-dev init
tofu-dev apply -concise

# update ./secrets/dev/k8s/observability.yaml
tofu-dev state show -show-sensitive google_storage_hmac_key.openobserve
tofu-dev state show -show-sensitive google_storage_hmac_key.k8up

nixidy

just build-nixidy dev
just switch-nixidy dev

kubectl access

just fetch-kubeconfig
screen -dm just forward-kubectl

bootstrapping cluster

tofu-dev apply
just sync dev

# because flakes are stupid
jj

just provision dev eevee
just provision dev vaporeon
...

just fetch-kubeconfig dev
screen -dm just forward-kubectl dev

patch-pod-cidrs
nixidy apply .#dev
nixidy bootstrap .#dev | kubectl apply -f-