1 From 272e50d0b0262e49cdcaad42cdab57aad183d1c2 Mon Sep 17 00:00:00 2001
3 <employee-pseudonym-7f597def-7eeb-47f8-b10a-0724f2ba59a9@google.com>
4 Date: Thu, 3 May 2018 22:24:58 -0700
5 Subject: [PATCH] Initial commit adding support for hetzner cloud
7 This is based on the digital ocean backend. It also uses nixos-infect. I extended nixos-infect to be generic
12 examples/trivial-hetzner-cloud.nix | 12 ++
13 nix/eval-machine-info.nix | 1 +
14 nix/hetzner-cloud.nix | 56 +++++++
16 nixops/backends/hetzner_cloud.py | 230 +++++++++++++++++++++++++++++
17 nixops/data/nixos-infect | 77 +++++++---
18 6 files changed, 354 insertions(+), 23 deletions(-)
19 create mode 100644 examples/trivial-hetzner-cloud.nix
20 create mode 100644 nix/hetzner-cloud.nix
21 create mode 100644 nixops/backends/hetzner_cloud.py
23 diff --git a/examples/trivial-hetzner-cloud.nix b/examples/trivial-hetzner-cloud.nix
25 index 000000000..c61add6bb
27 +++ b/examples/trivial-hetzner-cloud.nix
30 + resources.sshKeyPairs.ssh-key = {};
32 + machine = { config, pkgs, ... }: {
33 + services.openssh.enable = true;
35 + deployment.targetEnv = "hetznerCloud";
36 + deployment.hetznerCloud.serverType = "cx11";
38 + networking.firewall.allowedTCPPorts = [ 22 ];
41 diff --git a/nix/eval-machine-info.nix b/nix/eval-machine-info.nix
42 index 2884b4b47..6a7205786 100644
43 --- a/nix/eval-machine-info.nix
44 +++ b/nix/eval-machine-info.nix
45 @@ -309,6 +309,7 @@ rec {
46 digitalOcean = optionalAttrs (v.config.deployment.targetEnv == "digitalOcean") v.config.deployment.digitalOcean;
47 gce = optionalAttrs (v.config.deployment.targetEnv == "gce") v.config.deployment.gce;
48 hetzner = optionalAttrs (v.config.deployment.targetEnv == "hetzner") v.config.deployment.hetzner;
49 + hetznerCloud = optionalAttrs (v.config.deployment.targetEnv == "hetznerCloud") v.config.deployment.hetznerCloud;
50 container = optionalAttrs (v.config.deployment.targetEnv == "container") v.config.deployment.container;
51 route53 = v.config.deployment.route53;
53 diff --git a/nix/hetzner-cloud.nix b/nix/hetzner-cloud.nix
55 index 000000000..21d148c1a
57 +++ b/nix/hetzner-cloud.nix
59 +{ config, pkgs, lib, utils, ... }:
63 +with import ./lib.nix lib;
66 + cfg = config.deployment.hetznerCloud;
72 + deployment.hetznerCloud.authToken = mkOption {
74 + example = "8b2f4e96af3997853bfd4cd8998958eab871d9614e35d63fab45a5ddf981c4da";
77 + The API auth token. We're checking the environment for
78 + <envar>HETZNER_CLOUD_AUTH_TOKEN</envar> first and if that is
79 + not set we try this auth token.
83 + deployment.hetznerCloud.datacenter = mkOption {
84 + example = "fsn1-dc8";
86 + type = types.nullOr types.str;
92 + deployment.hetznerCloud.location = mkOption {
95 + type = types.nullOr types.str;
101 + deployment.hetznerCloud.serverType = mkOption {
105 + Name or id of server types.
110 + config = mkIf (config.deployment.targetEnv == "hetznerCloud") {
111 + nixpkgs.system = mkOverride 900 "x86_64-linux";
112 + services.openssh.enable = true;
115 diff --git a/nix/options.nix b/nix/options.nix
116 index 0866c3ab8..db021f74d 100644
117 --- a/nix/options.nix
118 +++ b/nix/options.nix
123 + ./hetzner-cloud.nix
127 diff --git a/nixops/backends/hetzner_cloud.py b/nixops/backends/hetzner_cloud.py
129 index 000000000..a2cb176b9
131 +++ b/nixops/backends/hetzner_cloud.py
133 +# -*- coding: utf-8 -*-
135 +A backend for hetzner cloud.
137 +This backend uses nixos-infect (which uses nixos LUSTRATE) to infect a
138 +hetzner cloud instance. The setup requires two reboots, one for
139 +the infect itself, another after we pushed the nixos image.
148 +import nixops.resources
149 +from nixops.backends import MachineDefinition, MachineState
150 +from nixops.nix_expr import Function, RawValue
152 +import nixops.known_hosts
154 +infect_path = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'data', 'nixos-infect'))
156 +API_HOST = 'api.hetzner.cloud'
158 +class ApiError(Exception):
161 +class ApiNotFoundError(ApiError):
164 +class HetznerCloudDefinition(MachineDefinition):
167 + return "hetznerCloud"
169 + def __init__(self, xml, config):
170 + MachineDefinition.__init__(self, xml, config)
171 + self.auth_token = config["hetznerCloud"]["authToken"]
172 + self.location = config["hetznerCloud"]["location"]
173 + self.datacenter = config["hetznerCloud"]["datacenter"]
174 + self.server_type = config["hetznerCloud"]["serverType"]
176 + def show_type(self):
177 + return "{0} [{1}]".format(self.get_type(), self.location or self.datacenter or 'any location')
180 +class HetznerCloudState(MachineState):
183 + return "hetznerCloud"
185 + state = nixops.util.attr_property("state", MachineState.MISSING, int) # override
186 + public_ipv4 = nixops.util.attr_property("publicIpv4", None)
187 + public_ipv6 = nixops.util.attr_property("publicIpv6", None)
188 + location = nixops.util.attr_property("hetznerCloud.location", None)
189 + datacenter = nixops.util.attr_property("hetznerCloud.datacenter", None)
190 + server_type = nixops.util.attr_property("hetznerCloud.serverType", None)
191 + auth_token = nixops.util.attr_property("hetznerCloud.authToken", None)
192 + server_id = nixops.util.attr_property("hetznerCloud.serverId", None, int)
194 + def __init__(self, depl, name, id):
195 + MachineState.__init__(self, depl, name, id)
198 + def get_ssh_name(self):
199 + return self.public_ipv4
201 + def get_ssh_flags(self, *args, **kwargs):
202 + super_flags = super(HetznerCloudState, self).get_ssh_flags(*args, **kwargs)
203 + return super_flags + [
204 + '-o', 'UserKnownHostsFile=/dev/null',
205 + '-o', 'StrictHostKeyChecking=no',
206 + '-i', self.get_ssh_private_key_file(),
209 + def get_physical_spec(self):
210 + return Function("{ ... }", {
211 + 'imports': [ RawValue('<nixpkgs/nixos/modules/profiles/qemu-guest.nix>') ],
212 + ('boot', 'loader', 'grub', 'device'): 'nodev',
213 + ('fileSystems', '/'): { 'device': '/dev/sda1', 'fsType': 'ext4'},
214 + ('users', 'extraUsers', 'root', 'openssh', 'authorizedKeys', 'keys'): [self.depl.active_resources.get('ssh-key').public_key],
217 + def get_ssh_private_key_file(self):
218 + return self.write_ssh_private_key(self.depl.active_resources.get('ssh-key').private_key)
220 + def create_after(self, resources, defn):
221 + # make sure the ssh key exists before we do anything else
223 + r for r in resources if
224 + isinstance(r, nixops.resources.ssh_keypair.SSHKeyPairState)
227 + def get_auth_token(self):
228 + return os.environ.get('HETZNER_CLOUD_AUTH_TOKEN', self.auth_token)
230 + def _api(self, path, method=None, data=None, json=True):
231 + """Basic wrapper around requests that handles auth and serialization."""
232 + assert path[0] == '/'
233 + url = 'https://%s%s' % (API_HOST, path)
234 + token = self.get_auth_token()
236 + raise Exception('No hetzner cloud auth token set')
238 + 'Authorization': 'Bearer '+self.get_auth_token(),
240 + res = requests.request(
246 + if res.status_code == 404:
247 + raise ApiNotFoundError('Not Found: %r' % path)
249 + raise ApiError('Response for %s %s has status code %d: %s' % (method, path, res.status_code, res.content))
253 + res_data = res.json()
254 + except ValueError as e:
255 + raise ApiError('Response for %s %s has invalid JSON (%s): %r' % (method, path, e, res.content))
259 + def destroy(self, wipe=False):
260 + if not self.server_id:
261 + self.log('server {} was never made'.format(self.name))
263 + self.log('destroying server {} with id {}'.format(self.name, self.server_id))
265 + res = self._api('/v1/servers/%s' % (self.server_id), method='DELETE')
266 + except ApiNotFoundError:
267 + self.log("server not found - assuming it's been destroyed already")
269 + self.public_ipv4 = None
270 + self.server_id = None
274 + def _create_ssh_key(self, public_key):
275 + """Create or get an ssh key and return an id."""
276 + public_key = public_key.strip()
277 + res = self._api('/v1/ssh_keys', method='GET')
278 + name = 'nixops-%s-%s' % (self.depl.uuid, self.name)
280 + for key in res['ssh_keys']:
281 + if key['public_key'].strip() == public_key:
283 + if key['name'] == name:
284 + deletes.append(key['id'])
286 + # This reply is empty, so don't decode json.
287 + self._api('/v1/ssh_keys/%d' % d, method='DELETE', json=False)
288 + res = self._api('/v1/ssh_keys', method='POST', data={
290 + 'public_key': public_key,
292 + return res['ssh_key']['id']
294 + def create(self, defn, check, allow_reboot, allow_recreate):
295 + ssh_key = self.depl.active_resources.get('ssh-key')
296 + if ssh_key is None:
297 + raise Exception('Please specify a ssh-key resource (resources.sshKeyPairs.ssh-key = {}).')
299 + self.set_common_state(defn)
301 + if self.server_id is not None:
304 + ssh_key_id = self._create_ssh_key(ssh_key.public_key)
308 + 'server_type': defn.server_type,
309 + 'start_after_create': True,
310 + 'image': 'debian-9',
316 + if defn.datacenter:
317 + req['datacenter'] = defn.datacenter
318 + elif defn.location:
319 + req['location'] = defn.location
321 + self.log_start("creating server ...")
322 + create_res = self._api('/v1/servers', method='POST', data=req)
323 + self.server_id = create_res['server']['id']
324 + self.public_ipv4 = create_res['server']['public_net']['ipv4']['ip']
325 + self.public_ipv6 = create_res['server']['public_net']['ipv6']['ip']
326 + self.datacenter = create_res['server']['datacenter']['name']
327 + self.location = create_res['server']['datacenter']['location']['name']
329 + action = create_res['action']
330 + action_path = '/v1/servers/%d/actions/%d' % (self.server_id, action['id'])
332 + while action['status'] == 'running':
334 + res = self._api(action_path, method='GET')
335 + action = res['action']
337 + if action['status'] != 'success':
338 + raise Exception('unexpected status: %s' % action['status'])
340 + self.log_end("{}".format(self.public_ipv4))
342 + self.wait_for_ssh()
343 + self.log_start("running nixos-infect")
344 + self.run_command('bash </dev/stdin 2>&1', stdin=open(infect_path))
347 + def reboot(self, hard=False):
349 + self.log("sending hard reset to server...")
350 + res = self._api('/v1/servers/%d/actions/reset' % self.server_id, method='POST')
351 + action = res['action']
352 + action_path = '/v1/servers/%d/actions/%d' % (self.server_id, action['id'])
353 + while action['status'] == 'running':
355 + res = self._api(action_path, method='GET')
356 + action = res['action']
357 + if action['status'] != 'success':
358 + raise Exception('unexpected status: %s' % action['status'])
359 + self.wait_for_ssh()
360 + self.state = self.STARTING
362 + MachineState.reboot(self, hard=hard)
363 diff --git a/nixops/data/nixos-infect b/nixops/data/nixos-infect
364 index 66634357b..437a2ec61 100644
365 --- a/nixops/data/nixos-infect
366 +++ b/nixops/data/nixos-infect
367 @@ -68,26 +68,49 @@ makeConf() {
370 # (nixos-generate-config will add qemu-user and bind-mounts, so avoid)
372 + if [ -e /dev/sda ]; then
377 cat > /etc/nixos/hardware-configuration.nix << EOF
380 imports = [ <nixpkgs/nixos/modules/profiles/qemu-guest.nix> ];
381 - boot.loader.grub.device = "/dev/vda";
382 - fileSystems."/" = { device = "/dev/vda1"; fsType = "ext4"; };
383 + boot.loader.grub.device = "${disk}";
384 + fileSystems."/" = { device = "${disk}1"; fsType = "ext4"; };
389 - ens3_ip4s=($(ip address show dev eth0 | grep 'inet ' | sed -r 's|.*inet ([0-9.]+)/([0-9]+).*|{ address="\1"; prefixLength=\2; }|'))
390 - ens3_ip6s=($(ip address show dev eth0 | grep 'inet6 .*global' | sed -r 's|.*inet6 ([0-9a-f:]+)/([0-9]+).*|{ address="\1"; prefixLength=\2; }|'))
391 - ens4_ip4s=($(ip address show dev eth1 | grep 'inet ' | sed -r 's|.*inet ([0-9.]+)/([0-9]+).*|{ address="\1"; prefixLength=\2; }|'))
392 - ens4_ip6s=($(ip address show dev eth1 | grep 'inet6 .*global' | sed -r 's|.*inet6 ([0-9a-f:]+)/([0-9]+).*|{ address="\1"; prefixLength=\2; }|'))
393 - gateway=($(ip route show dev eth0 | grep default | sed -r 's|default via ([0-9.]+).*|\1|'))
394 - gateway6=($(ip -6 route show dev eth0 | grep default | sed -r 's|default via ([0-9a-f:]+).*|\1|'))
395 - ether0=($(ip address show dev eth0 | grep link/ether | sed -r 's|.*link/ether ([0-9a-f:]+) .*|\1|'))
396 - ether1=($(ip address show dev eth1 | grep link/ether | sed -r 's|.*link/ether ([0-9a-f:]+) .*|\1|'))
397 + gateway=($(ip route show | grep default | sed -r 's|default via ([0-9.]+).*|\1|'))
398 + gateway6=($(ip -6 route show | grep default | sed -r 's|default via ([0-9a-f:]+).*|\1|'))
399 + interfaces=($(ip link | awk -F ': ' '/^[0-9]*: / {if ($2 != "lo") {print $2}}'))
400 nameservers=($(grep ^nameserver /etc/resolv.conf | cut -f2 -d' '))
402 + # Predict the predictable name for each interface since that is enabled in
403 + # the nixos system.
404 + declare -A predictable_names
405 + for interface in ${interfaces[@]}; do
406 + # udevadm prints out the candidate names which will be selected if
407 + # available in this order.
408 + local name=$(udevadm info /sys/class/net/$interface | awk -F = '
409 + /^E: ID_NET_NAME_FROM_DATABASE=/ {arr[1]=$2}
410 + /^E: ID_NET_NAME_ONBOARD=/ {arr[2]=$2}
411 + /^E: ID_NET_NAME_SLOT=/ {arr[3]=$2}
412 + /^E: ID_NET_NAME_PATH=/ {arr[4]=$2}
413 + /^E: ID_NET_NAME_MAC=/ {arr[5]=$2}
414 + END {for (i=1;i<6;i++) {if (length(arr[i]) > 0) { print arr[i]; break}}}')
415 + if [ -z "$name" ]; then
416 + echo Could not determine predictable name for interface $interface
418 + predictable_names[$interface]=$name
421 + # Take a gamble on the first interface being able to reach the gateway.
422 + local default_interface=${predictable_names[${interfaces[0]}]}
424 cat > /etc/nixos/networking.nix << EOF
426 # This file was populated at runtime with the networking
427 @@ -96,25 +119,27 @@ EOF
428 nameservers = [$(for a in ${nameservers[@]}; do echo -n "
431 - defaultGateway = "${gateway}";
432 - defaultGateway6 = "${gateway6}";
433 + defaultGateway = {address = "${gateway}"; interface = "${default_interface}";};
434 + defaultGateway6 = {address = "${gateway6}"; interface = "${default_interface}";};
437 - ip4 = [$(for a in ${ens3_ip4s[@]}; do echo -n "
440 - ip6 = [$(for a in ${ens3_ip6s[@]}; do echo -n "
445 - ip4 = [$(for a in ${ens4_ip4s[@]}; do echo -n "
448 + for interface in ${interfaces[@]}; do
449 + ip4s=($(ip address show dev $interface | grep 'inet ' | sed -r 's|.*inet ([0-9.]+)/([0-9]+).*|{ address="\1"; prefixLength=\2; }|'))
450 + ip6s=($(ip address show dev $interface | grep 'inet6 .*global' | sed -r 's|.*inet6 ([0-9a-f:]+)/([0-9]+).*|{ address="\1"; prefixLength=\2; }|'))
451 + cat >> /etc/nixos/networking.nix << EOF
452 + ${predictable_names[$interface]} = {
453 + ip4 = [$(for a in ${ip4s[@]}; do echo -n "
456 - ip6 = [$(for a in ${ens4_ip6s[@]}; do echo -n "
457 + ip6 = [$(for a in ${ip6s[@]}; do echo -n "
464 + cat >> /etc/nixos/networking.nix << EOF
468 @@ -154,6 +179,12 @@ export HOME="/root"
469 groupadd -r nixbld -g 30000
470 seq 1 10 | xargs -I{} useradd -c "Nix build user {}" -d /var/empty -g nixbld -G nixbld -M -N -r -s `which nologin` nixbld{}
472 +if ! which curl >/dev/null 2>/dev/null; then
473 + if which apt-get >/dev/null 2>/dev/null; then
474 + apt-get update && apt-get install -y curl
478 curl https://nixos.org/nix/install | sh
480 source ~/.nix-profile/etc/profile.d/nix.sh