Fist attempt to factor microOS install

modules/host/locals.tf

@@ -0,0 +1,43 @@
+locals {
+  ssh_public_key = trimspace(file(var.public_key))
+  # ssh_private_key is either the contents of var.private_key or null to use a ssh agent.
+  ssh_private_key = var.private_key == null ? null : trimspace(file(var.private_key))
+  # ssh_identity is not set if the private key is passed directly, but if ssh agent is used, the public key tells ssh agent which private key to use.
+  # For terraforms provisioner.connection.agent_identity, we need the public key as a string.
+  ssh_identity = var.private_key == null ? local.ssh_public_key : null
+  # ssh_identity_file is used for ssh "-i" flag, its the private key if that is set, or a public key file
+  # if an ssh agent is used.
+  ssh_identity_file = var.private_key == null ? var.public_key : var.private_key
+  # shared flags for ssh to ignore host keys, to use our ssh identity file for all connections during provisioning.
+  ssh_args = "-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i ${local.ssh_identity_file}"
+
+  microOS_install_commands = [
+    "set -ex",
+    "apt-get update",
+    "apt-get install -y aria2",
+    "aria2c --follow-metalink=mem https://download.opensuse.org/tumbleweed/appliances/openSUSE-MicroOS.x86_64-kvm-and-xen.qcow2.meta4",
+    "qemu-img convert -p -f qcow2 -O host_device $(ls -a | grep -ie '^opensuse.*microos.*qcow2$') /dev/sda",
+    "sgdisk -e /dev/sda",
+    "parted -s /dev/sda resizepart 4 99%",
+    "parted -s /dev/sda mkpart primary ext2 99% 100%",
+    "partprobe /dev/sda && udevadm settle && fdisk -l /dev/sda",
+    "mount /dev/sda4 /mnt/ && btrfs filesystem resize max /mnt && umount /mnt",
+    "mke2fs -L ignition /dev/sda5",
+    "mount /dev/sda5 /mnt",
+    "mkdir /mnt/ignition",
+    "cp /root/config.ign /mnt/ignition/config.ign",
+    "mkdir /mnt/combustion",
+    "cp /root/script /mnt/combustion/script",
+    "umount /mnt"
+  ]
+
+  combustion_script = <<EOF
+#!/bin/bash
+# combustion: network
+rpm --import https://rpm.rancher.io/public.key
+zypper refresh
+zypper --gpg-auto-import-keys install -y https://rpm.rancher.io/k3s/stable/common/microos/noarch/k3s-selinux-0.4-1.sle.noarch.rpm
+udevadm settle
+EOF
+
+}

modules/host/main.tf

@@ -0,0 +1,71 @@
+resource "hcloud_server" "server" {
+  name = var.name
+
+  image              = "ubuntu-20.04"
+  rescue             = "linux64"
+  server_type        = var.server_type
+  location           = var.location
+  ssh_keys           = var.ssh_keys
+  firewall_ids       = var.firewall_ids
+  placement_group_id = var.placement_group_id
+
+
+  labels = var.labels
+
+  network {
+    network_id = var.network_id
+    ip         = var.ip
+  }
+
+  connection {
+    user           = "root"
+    private_key    = local.ssh_private_key
+    agent_identity = local.ssh_identity
+    host           = self.ipv4_address
+  }
+
+  provisioner "file" {
+    content = templatefile("${path.module}/templates/config.ign.tpl", {
+      name           = self.name
+      ssh_public_key = local.ssh_public_key
+    })
+    destination = "/root/config.ign"
+  }
+
+  # Combustion script file to install k3s-selinux
+  provisioner "file" {
+    content     = local.combustion_script
+    destination = "/root/script"
+  }
+
+  # Install MicroOS
+  provisioner "remote-exec" {
+    inline = local.microOS_install_commands
+  }
+
+  # Issue a reboot command
+  provisioner "local-exec" {
+    command = "ssh ${local.ssh_args} root@${self.ipv4_address} '(sleep 2; reboot)&'; sleep 3"
+  }
+
+  # Wait for MicroOS to reboot and be ready
+  provisioner "local-exec" {
+    command = <<-EOT
+      until ssh ${local.ssh_args} -o ConnectTimeout=2 root@${self.ipv4_address} true 2> /dev/null
+      do
+        echo "Waiting for MicroOS to reboot and become available..."
+        sleep 2
+      done
+    EOT
+  }
+
+  # Run the agent
+  provisioner "remote-exec" {
+    inline = [
+      # set the hostname in a persistent fashion
+      "hostnamectl set-hostname ${self.name}",
+      # Disable automatic reboot (after transactional updates), and configure the reboot method as kured
+      "rebootmgrctl set-strategy off && echo 'REBOOT_METHOD=kured' > /etc/transactional-update.conf"
+    ]
+  }
+}

modules/host/out.tf

@@ -0,0 +1,12 @@
+output "ipv4_address" {
+  value = hcloud_server.server.ipv4_address
+}
+
+
+output "name" {
+  value = hcloud_server.server.name
+}
+
+output "id" {
+  value = hcloud_server.server.id
+}

modules/host/templates/config.ign.tpl

@@ -0,0 +1,31 @@
+{
+  "ignition": {
+    "version": "3.0.0"
+  },
+  "passwd": {
+    "users": [
+      {
+        "name": "root",
+        "sshAuthorizedKeys": [
+          "${ssh_public_key}"
+        ]
+      }
+    ]
+  },
+  "storage": {
+    "files": [
+      {
+        "path": "/etc/sysconfig/network/ifcfg-eth1",
+        "mode": 420,
+        "overwrite": true,
+        "contents": { "source": "data:,BOOTPROTO%3D%27dhcp%27%0ASTARTMODE%3D%27auto%27" }
+      },
+      {
+        "path": "/etc/ssh/sshd_config.d/kube-hetzner.conf",
+        "mode": 420,
+        "overwrite": true,
+        "contents": { "source": "data:,PasswordAuthentication%20no%0AX11Forwarding%20no%0AMaxAuthTries%202%0AAllowTcpForwarding%20no%0AAllowAgentForwarding%20no%0AAuthorizedKeysFile%20.ssh%2Fauthorized_keys" }
+      }
+    ]
+  }
+}

modules/host/variables.tf

@@ -0,0 +1,65 @@
+variable "hcloud_token" {
+  description = "Hetzner Cloud API Token"
+  type        = string
+  sensitive   = true
+}
+
+variable "name" {
+  description = "Host name"
+  type        = string
+}
+
+variable "public_key" {
+  description = "SSH public Key."
+  type        = string
+}
+
+variable "private_key" {
+  description = "SSH private Key."
+  type        = string
+}
+
+variable "ssh_keys" {
+  description = "List of SSH key IDs"
+  type        = list(string)
+  nullable    = true
+}
+
+variable "firewall_ids" {
+  description = "Set of firewal IDs"
+  type        = set(number)
+  nullable    = true
+}
+
+variable "placement_group_id" {
+  description = "Placement group ID"
+  type        = number
+  nullable    = true
+}
+
+variable "labels" {
+  description = "Labels"
+  type        = map(any)
+  nullable    = true
+}
+
+variable "location" {
+  description = "The server location"
+  type        = string
+}
+
+variable "network_id" {
+  description = "The network or subnet id"
+  type        = number
+}
+
+variable "ip" {
+  description = "The IP"
+  type        = string
+  nullable    = true
+}
+
+variable "server_type" {
+  description = "The server type"
+  type        = string
+}

modules/host/versions.tf

@@ -0,0 +1,16 @@
+terraform {
+  required_providers {
+    hcloud = {
+      source  = "hetznercloud/hcloud"
+      version = ">= 1.0.0, < 2.0.0"
+    }
+    local = {
+      source  = "hashicorp/local"
+      version = ">= 2.0.0, < 3.0.0"
+    }
+    remote = {
+      source  = "tenstad/remote"
+      version = "~> 0.0.23"
+    }
+  }
+}