Skip to content

Commit 5b9d09f

Browse files
spietrasgithub-actions[bot]
spietras
and
github-actions[bot]
authored
Added template files (#5)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
1 parent 3616eed commit 5b9d09f

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

44 files changed

+23312
-1
lines changed

‎.copier-answers.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# Changes here will be overwritten by Copier; NEVER EDIT MANUALLY
2+
_commit: d7e23a0
3+
_src_path: ./
4+
accountname: quickplates
5+
backend: local
6+
description: Terraform resources example 🌎
7+
docs: true
8+
docsurl: https://quickplates.github.io/terraform-example
9+
projectname: terraform-example
10+
reponame: terraform-example
11+
repourl: https://github.com/quickplates/terraform-example
12+
statefile: terraform.tfstate

‎.devcontainer/devcontainer.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"build": {
3+
"context": "image/",
4+
"dockerfile": "image/Dockerfile",
5+
"options": ["--network=host"]
6+
},
7+
"customizations": {
8+
"vscode": {
9+
"extensions": [
10+
"hashicorp.terraform",
11+
"jnoortheen.nix-ide",
12+
"mkhl.direnv",
13+
"task.vscode-task",
14+
"Trunk.io"
15+
],
16+
"settings": {
17+
"[nix]": {
18+
"editor.defaultFormatter": "jnoortheen.nix-ide"
19+
},
20+
"editor.defaultFormatter": "trunk.io",
21+
"nix.enableLanguageServer": true,
22+
"nix.serverPath": "nil",
23+
"nix.serverSettings": {
24+
"nil": {
25+
"formatting": {
26+
"command": ["nix", "fmt", "--", "-"]
27+
}
28+
}
29+
},
30+
"remote.autoForwardPorts": false
31+
}
32+
}
33+
},
34+
"features": {
35+
"ghcr.io/devcontainers-extra/features/direnv:1.0.3": {
36+
"version": "2.37.1"
37+
},
38+
"ghcr.io/devcontainers-extra/features/starship:1.0.10": {
39+
"version": "1.24.0"
40+
},
41+
"ghcr.io/devcontainers/features/nix:1.2.0": {
42+
"extraNixConfig": "experimental-features = nix-command flakes",
43+
"version": "2.28.5"
44+
}
45+
},
46+
"mounts": [
47+
"source=devcontainer-shared-secrets,target=/secrets/,type=volume",
48+
"source=devcontainer-${devcontainerId}-nix,target=/nix/,type=volume",
49+
"source=devcontainer-${devcontainerId}-shellhistory-persist,target=/persist/shellhistory/,type=volume",
50+
"source=devcontainer-shared-trunk-cache,target=/cache/trunk/,type=volume",
51+
"source=devcontainer-shared-npm-cache,target=/cache/npm/,type=volume"
52+
],
53+
"onCreateCommand": "/hooks/create.sh",
54+
"remoteEnv": {
55+
"WORKSPACE": "${containerWorkspaceFolder}"
56+
},
57+
"runArgs": [
58+
"--uts=host",
59+
"--ipc=host",
60+
"--network=host",
61+
"--userns=host",
62+
"--cgroupns=host",
63+
"--privileged"
64+
]
65+
}

‎.devcontainer/image/Dockerfile‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# Using one of the offical dev container images as base
2+
# Going with Ubuntu, because it has glibc, which some tools might need
3+
# It also has git, zsh and a bunch of other stuff preinstalled
4+
# Also, it includes a non-root 'vscode' user with sudo access
5+
# The version is pinned to ensure reproducibility
6+
FROM mcr.microsoft.com/devcontainers/base:1.2.6-ubuntu-24.04
7+
8+
ENV REMOTE_USER=vscode
9+
10+
# Setup script
11+
COPY setup.sh /tmp/setup.sh
12+
13+
RUN /tmp/setup.sh && \
14+
rm /tmp/setup.sh
15+
16+
# Lifecycle hooks
17+
COPY hooks/ /hooks/

‎.devcontainer/image/hooks/create.sh‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
#!/usr/bin/env bash
2+
3+
# Create shell history cache files if they don't exist for some reason
4+
touch /persist/shellhistory/.bash_history
5+
touch /persist/shellhistory/.zsh_history
6+
7+
# Use GitHub token secret if it exists
8+
if [[ -s /secrets/.ghtoken && -r /secrets/.ghtoken ]]; then
9+
token="$(cat /secrets/.ghtoken)"
10+
confighome="${XDG_CONFIG_HOME:-${HOME}/.config/}"
11+
12+
# Add GitHub token to Nix config
13+
configfile="${confighome}/nix/nix.conf"
14+
tmpfile="$(mktemp)"
15+
16+
mkdir --parents "$(dirname "${configfile}")"
17+
touch "${configfile}"
18+
19+
if grep --quiet extra-access-tokens "${configfile}"; then
20+
sed "s|extra-access-tokens.*|extra-access-tokens = github.com=${token}|" "${configfile}" >"${tmpfile}"
21+
cat "${tmpfile}" >"${configfile}"
22+
rm "${tmpfile}"
23+
else
24+
echo "extra-access-tokens = github.com=${token}" >>"${configfile}"
25+
fi
26+
fi
27+
28+
# Use age keys for SOPS if they exist
29+
if [[ -s /secrets/.agekeys && -r /secrets/.agekeys ]]; then
30+
confighome="${XDG_CONFIG_HOME:-${HOME}/.config/}"
31+
32+
# Copy age keys to SOPS config
33+
targetfile="${confighome}/sops/age/keys.txt"
34+
mkdir --parents "$(dirname "${targetfile}")"
35+
cp --force /secrets/.agekeys "${targetfile}"
36+
fi

‎.devcontainer/image/setup.sh‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
#!/usr/bin/env bash
2+
3+
REMOTE_USER="${REMOTE_USER:?}"
4+
REMOTE_USER_PASSWD="$(getent passwd "${REMOTE_USER}")"
5+
REMOTE_USER_HOME="$(echo "${REMOTE_USER_PASSWD}" | cut --delimiter ':' --fields 6)"
6+
7+
# Setup default shell
8+
chsh --shell /usr/bin/zsh "${REMOTE_USER}"
9+
10+
# Setup direnv
11+
cat <<EOF >>"${REMOTE_USER_HOME}/.bashrc"
12+
eval "\$(direnv hook bash)"
13+
EOF
14+
15+
cat <<EOF >>"${REMOTE_USER_HOME}/.zshrc"
16+
eval "\$(direnv hook zsh)"
17+
EOF
18+
19+
# Setup starship
20+
cat <<EOF >>"${REMOTE_USER_HOME}/.bashrc"
21+
eval "\$(starship init bash)"
22+
EOF
23+
24+
cat <<EOF >>"${REMOTE_USER_HOME}/.zshrc"
25+
eval "\$(starship init zsh)"
26+
EOF
27+
28+
# Setup secrets directory
29+
mkdir --parents /secrets/
30+
31+
chown --recursive "${REMOTE_USER}:" /secrets/
32+
33+
# Setup shell history cache
34+
mkdir --parents /persist/shellhistory/
35+
36+
touch /persist/shellhistory/.bash_history
37+
touch /persist/shellhistory/.zsh_history
38+
39+
chown --recursive "${REMOTE_USER}:" /persist/shellhistory/
40+
41+
cat <<EOF >>"${REMOTE_USER_HOME}/.bashrc"
42+
export HISTFILE=/persist/shellhistory/.bash_history
43+
EOF
44+
45+
cat <<EOF >>"${REMOTE_USER_HOME}/.zshrc"
46+
export HISTFILE=/persist/shellhistory/.zsh_history
47+
EOF
48+
49+
# Setup trunk cache
50+
mkdir --parents /cache/trunk/
51+
52+
chown --recursive "${REMOTE_USER}:" /cache/trunk/
53+
54+
cat <<EOF >>"${REMOTE_USER_HOME}/.bashrc"
55+
export TRUNK_CACHE=/cache/trunk/
56+
EOF
57+
58+
cat <<EOF >>"${REMOTE_USER_HOME}/.zshrc"
59+
export TRUNK_CACHE=/cache/trunk/
60+
EOF
61+
62+
# Setup npm cache
63+
mkdir --parents /cache/npm/
64+
65+
chown --recursive "${REMOTE_USER}:" /cache/npm/
66+
67+
cat <<EOF >>"${REMOTE_USER_HOME}/.bashrc"
68+
export NPM_CONFIG_CACHE=/cache/npm/
69+
EOF
70+
71+
cat <<EOF >>"${REMOTE_USER_HOME}/.zshrc"
72+
export NPM_CONFIG_CACHE=/cache/npm/
73+
EOF

‎.envrc‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/usr/bin/env bash
2+
3+
# reload when these files change
4+
watch_file flake.lock ./*.nix
5+
6+
# activate the default development shell in the current shell
7+
# --accept-flake-config will accept the nix configuration from the flake without prompting
8+
eval "$(nix print-dev-env path:./ --accept-flake-config)" || true

‎.gitattributes‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# Mark everything as vendored
2+
* linguist-vendored
3+
# Treat docs as documentation
4+
/docs/** -linguist-vendored linguist-documentation
5+
# Unmark files in src, so that they are included in language stats
6+
/src/** -linguist-vendored

‎.github/workflows/apply.yaml‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
name: Apply
2+
3+
# Only one workflow can run at a time
4+
# If there is newer workflow in progress, cancel older ones
5+
concurrency:
6+
group: apply
7+
cancel-in-progress: true
8+
9+
# Put 'on' in quotes to avoid YAML parsing error
10+
"on":
11+
# Enable manual triggering
12+
workflow_dispatch: {}
13+
# Run on commits to main branch
14+
push:
15+
branches:
16+
- main
17+
# Run only on changes to relevant files
18+
paths:
19+
- .github/workflows/apply.yaml
20+
- src/**
21+
- .sops.yaml
22+
- flake.lock
23+
- "*.nix"
24+
- Taskfile.dist.yaml
25+
26+
jobs:
27+
apply:
28+
name: Apply
29+
# Pin version of Ubuntu to avoid breaking changes
30+
runs-on: ubuntu-24.04
31+
# Use reasonable timeout to avoid stuck workflows
32+
timeout-minutes: 10
33+
# Use main environment
34+
environment:
35+
name: main
36+
env:
37+
NIX_CACHE_DIR: /home/runner/.nixcache/
38+
TERRAFORM_BACKEND_CONFIG: /home/runner/config.tfbackend
39+
TERRAFORM_CACHE_DIR: /home/runner/.terraformcache/
40+
permissions:
41+
# Needed to checkout code
42+
contents: read
43+
steps:
44+
- name: Checkout code
45+
uses: actions/[email protected]
46+
- name: Setup Nix cache
47+
uses: actions/[email protected]
48+
id: cache-nix
49+
with:
50+
path: ${{ env.NIX_CACHE_DIR }}
51+
key: apply-nix
52+
- name: Setup Terraform cache
53+
uses: actions/[email protected]
54+
id: cache-terraform
55+
with:
56+
path: ${{ env.TERRAFORM_CACHE_DIR }}
57+
key: apply-terraform
58+
# Create Terraform cache directory if not imported from cache
59+
- name: Create Terraform cache directory
60+
if: steps.cache-terraform.outputs.cache-hit != 'true'
61+
run: >-
62+
mkdir
63+
--parents
64+
${{ env.TERRAFORM_CACHE_DIR }}
65+
- name: Install Nix
66+
uses: cachix/[email protected]
67+
with:
68+
github_access_token: ${{ github.token }}
69+
install_url: https://releases.nixos.org/nix/nix-2.28.5/install
70+
# See: https://github.com/cachix/install-nix-action/issues/56
71+
- name: Import Nix store cache
72+
if: steps.cache-nix.outputs.cache-hit == 'true'
73+
run: >-
74+
nix-store
75+
--import
76+
< ${{ env.NIX_CACHE_DIR }}/archive.nar
77+
- name: Create backend configuration
78+
run: |-
79+
cat <<EOF > ${{ env.TERRAFORM_BACKEND_CONFIG }}
80+
EOF
81+
- name: Initialize
82+
env:
83+
SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
84+
TF_PLUGIN_CACHE_DIR: ${{ env.TERRAFORM_CACHE_DIR }}
85+
run: >-
86+
nix
87+
develop
88+
./#terraform
89+
--command
90+
--
91+
task
92+
init
93+
--
94+
-input=false
95+
-backend-config=${{ env.TERRAFORM_BACKEND_CONFIG }}
96+
- name: Apply
97+
env:
98+
SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
99+
TF_PLUGIN_CACHE_DIR: ${{ env.TERRAFORM_CACHE_DIR }}
100+
run: >-
101+
nix
102+
develop
103+
./#terraform
104+
--command
105+
--
106+
task
107+
apply
108+
--
109+
-input=false
110+
-auto-approve
111+
# See: https://github.com/cachix/install-nix-action/issues/56
112+
- name: Export Nix store cache
113+
if: "!cancelled()"
114+
run: >-
115+
mkdir
116+
--parents
117+
${{ env.NIX_CACHE_DIR }}
118+
&&
119+
nix-store
120+
--export $(find /nix/store/ -maxdepth 1 -name '*-*')
121+
> ${{ env.NIX_CACHE_DIR }}/archive.nar

0 commit comments

Comments
 (0)