Deploying to AWS with Terraform and Nix

{ ... }:
{
  # Put your NixOS configuration here. Eg:
  services.nginx.enable = true;
}

{ modulesPath, ... }:
{
  imports = [
    "${modulesPath}/virtualisation/amazon-image.nix"
    # path to your config
    ./configuration.nix
  ];
}

variable "name" {
  description = "Name prefix"
}

# Generate a SSH key-pair
resource "tls_private_key" "machine" {
  algorithm = "RSA"
}

# Record the SSH public key into AWS
resource "aws_key_pair" "machine" {
  key_name   = var.name
  public_key = tls_private_key.machine.public_key_openssh
}

# Store the private key locally. This is going to be used by the deploy_nixos module below
# to deploy NixOS.
resource "local_file" "machine_ssh_key" {
  sensitive_content = tls_private_key.machine.private_key_pem
  filename          = "${path.module}/id_rsa.pem"
  file_permission   = "0600"
}

# This is the security group that will be attached to the instance
resource "aws_security_group" "machine" {
  name = var.name
}

# A bunch of rules for the group
resource "aws_security_group_rule" "machine_ingress_ssh" {
  description       = "Allow SSH from everywhere"
  type              = "ingress"
  from_port         = 22
  to_port           = 22
  protocol          = "tcp"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = aws_security_group.machine.id
}

resource "aws_security_group_rule" "machine_ingress_http" {
  description              = "Allow HTTP from everywhere"
  type                     = "ingress"
  from_port                = 80
  to_port                  = 80
  protocol                 = "tcp"
  cidr_blocks              = ["0.0.0.0/0"]
  security_group_id        = aws_security_group.machine.id
}

resource "aws_security_group_rule" "machine_egress_all" {
  description       = "Allow to connect to the whole Internet"
  type              = "egress"
  from_port         = 0
  to_port           = 0
  protocol          = "-1"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = aws_security_group.machine.id
}

# Permissions for the AWS instance
data "aws_iam_policy_document" "machine" {
  statement {
    sid = "1"

    actions = [
      "s3:ListAllMyBuckets",
      "s3:GetBucketLocation",
    ]

    resources = [
      "arn:aws:s3:::*",
    ]
  }
}

# A bunch of IAM resources needed to give permissions to the instance
resource "aws_iam_role" "machine" {
  name = var.name

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF
}

resource "aws_iam_role_policy" "machine" {
  name   = var.name
  role   = aws_iam_role.machine.name
  policy = data.aws_iam_policy_document.machine.json
}

resource "aws_iam_instance_profile" "machine" {
  name       = var.name
  role       = aws_iam_role.machine.name
  depends_on = [aws_iam_role_policy.machine]
}

# The actual AWS instance
resource "aws_instance" "machine" {
  # Base image to start the instance with
  ami                  = module.nixos_image.ami
  iam_instance_profile = aws_iam_instance_profile.machine.id
  instance_type        = "c5.large"
  key_name             = aws_key_pair.machine.key_name
  security_groups      = [aws_security_group.machine.name]
  tags                 = { "Name" = var.name }

  root_block_device {
    volume_type = "gp2"
    volume_size = "50" # GiB
  }

  lifecycle {
    create_before_destroy = true
  }
}

# This deploys the NixOS configuration onto the VM
module "machine_deploy" {
  source = "[email protected]:tweag/terraform-nixos.git//deploy_nixos?ref=dbba649db86d90166d7573bb60ba40ac790e17d1"

  # FIXME: pin nixpkgs
  # NIX_PATH = "nixpkgs=${path.module}/../../nix/nixpkgs.nix"
  nixos_config = "${path.module}/configuration.nix"

  target_host          = aws_instance.machine.public_ip
  target_user          = "root"
  ssh_private_key_file = local_file.machine_ssh_key.filename

  triggers = {
    # Force a new deployment if the instance ID has changed. The ID changes if
    # the instance is re-created for example.
    machine_id = aws_instance.machine.id
  }
}