From 54c1b7fce0989b56f107bebc9341fc62c235d4f1 Mon Sep 17 00:00:00 2001
From: Rafael Oliveira <rmfseo@kth.se>
Date: Thu, 19 Sep 2024 17:44:44 +0200
Subject: [PATCH] add tofu auto-deployment workflows

---
 .github/workflows/tofu-apply.yml | 25 +++++++++++++++++++++
 .github/workflows/tofu-plan.yml  | 37 ++++++++++++++++++++++++++++++++
 profiles/users.nix               | 11 ++++++++++
 3 files changed, 73 insertions(+)
 create mode 100644 .github/workflows/tofu-apply.yml
 create mode 100644 .github/workflows/tofu-plan.yml

diff --git a/.github/workflows/tofu-apply.yml b/.github/workflows/tofu-apply.yml
new file mode 100644
index 0000000..0eb97d5
--- /dev/null
+++ b/.github/workflows/tofu-apply.yml
@@ -0,0 +1,25 @@
+name: Apply OpenTofu plan
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  apply:
+    runs-on: ubuntu-latest
+    name: Apply pre-prepared plan
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+
+      - name: tofu apply
+        uses: dflook/terraform-apply@v1
+        with:
+            label: dsekt-infra
diff --git a/.github/workflows/tofu-plan.yml b/.github/workflows/tofu-plan.yml
new file mode 100644
index 0000000..fa5cccb
--- /dev/null
+++ b/.github/workflows/tofu-plan.yml
@@ -0,0 +1,37 @@
+name: Create OpenTofu plan
+
+on: [pull_request]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  plan:
+    runs-on: ubuntu-latest
+    name: Create a plan for the changes introduced
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      NOMAD_ADDR: ${{ vars.NOMAD_ADDR }}
+      NOMAD_TOKEN: ${{ secrets.NOMAD_TOKEN }}
+
+      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+
+      - uses: webfactory/ssh-agent@v0.9.0
+        with:
+          ssh-private-key: ${{ secrets.TF_SSH_PRIVATE_KEY }}
+
+      - name: tofu plan
+        uses: dflook/tofu-plan@v1
+        with:
+          label: dsekt-infra
+          variables: |
+            hcloud_token = "${{ secrets.TF_HCLOUD_TOKEN }}"
+            cloudflare_api_token = "${{ secrets.TF_CLOUDFLARE_TOKEN }}"
+            ssh_user = "${{ vars.TF_SSH_USER }}"
diff --git a/profiles/users.nix b/profiles/users.nix
index 282750d..a0acec9 100644
--- a/profiles/users.nix
+++ b/profiles/users.nix
@@ -26,4 +26,15 @@
     hashedPassword = "$y$j9T$wGjTUbozJn.GeZyKWYgBc/$U9zB.YZUX5jbmN429t46UmLeFp/CNMf1GMoKOFoUG25";
     shell = pkgs.zsh;
   };
+
+  # for GitHub actions
+  users.users.deploy = {
+    isNormalUser = true;
+    group = "deploy";
+    extraGroups = [ "wheel" ];
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGu5y70OdRRjeD0PbBYZ0D9+d9xaRHHCRogTgiXqcnvE deploy@infra-gh"
+    ];
+    shell = pkgs.bash;
+  };
 }