Bootstrap Guide

This document outlines the manual steps required to initialize the NixOS GitOps environment on a fresh Proxmox host. You must perform these steps before the CI/CD pipeline or any automated staging environments can function.

Secret Management Initialization

We use sops-nix to manage secrets, separating between Production and Staging.

Prerequisites: Install age (age documentation).

Generate the Production Master Key
```
age-keygen -o prod-master.age
```
It is recommended to generate this key on a secure offline workstation. The private key should be stored in a secure offline location, such as a USB drive or printed on paper. Avoid storing this private key on any server.
Generate the Staging Master Key
```
age-keygen -o staging-master.age
```
Update Configuration

Replace both placeholders in .sops.yaml with the newly generated public keys. Commit and push this change.

Proxmox Host Initialization & Authentication

The CI/CD pipeline needs restricted API access to Proxmox to provision Virtual Machines. We use OpenTofu to provision the bare-metal host.

Find your Raw Disk ID

The current OpenTofu configuration assumes that your system has a 2TB disk attached to the Proxmox host. This disk will be formatted and used for VM storage.

Determine the persistent hardware ID of your 2TB disk, using the following command:
```
ls -l /dev/disk/by-id/
```
It is recommended to use the persistent hardware ID (e.g., wwn-0x..., nvme-eui..., or ata-...) instead of /dev/sdb because the latter can change between reboots.
Action Required: Provide this ID to the system or update the opentofu/nodes/pve-new/main.tf configuration with this ID.

Apply the OpenTofu Host State

Prerequisites: Install opentofu (OpenTofu installation).

Initialize and apply the state. You will be prompted to enter your root@pam Proxmox credentials.

# Navigate to the OpenTofu host directory
cd opentofu/host
# Initialize and apply the OpenTofu configuration
tofu init
tofu apply

Upon successful completion, OpenTofu will output a secure API Token. Copy this token securely.

Forgejo Secrets Configuration

The CI/CD actions require access to the Proxmox token and the staging secret key.

Navigate to your Forgejo Web UI.
Go to Settings > Actions > Secrets for this repository.
Add the following repository secrets:
- PROXMOX_TOKEN_SECRET: Paste the token generated from Step 2.
- RENOVATE_TOKEN: Create a Personal Access Token (PAT) for your user in Forgejo with read/write access to code and pull requests, and paste it here.

Staging Golden Key Provisioning (Proxmox Snippet)

Instead of relying on Forgejo CI/CD to store the staging private key, we use a secure hypervisor-level Cloud-Init snippet.

SSH into your Proxmox server (pve).

Create the Cloud-Init snippet file:

cat << 'EOF' > /var/lib/vz/snippets/staging-key.yaml
#cloud-config
write_files:
  - path: /var/lib/sops-nix/key.txt
    permissions: '0600'
    content: |
      AGE-SECRET-KEY-1... (paste your staging-master private key here)
runcmd:
  - echo "Staging age key injected successfully."
EOF

This completely removes the secret from Forgejo. When OpenTofu spins up a staging VM, it simply tells Proxmox to attach this local snippet!

TrueNAS API Security (RBAC)

To prevent the CI/CD pipeline from having root access to your TrueNAS server, you must run the RBAC bootstrap script to create a restricted user (forgejo-ci) that can only clone datasets for staging, not destroy production data.

Ensure you have network access to your TrueNAS host.
Execute the RBAC setup script:
```
./scripts/truenas-rbac-setup.sh
```
Provide your TrueNAS IP and the root Admin API Token when prompted.
The script will automatically create the custom ci-runner-role and the forgejo-ci user.
Follow the terminal output instructions to log into the TrueNAS Web UI as the new user and generate the restricted API token.
Use this restricted token for the TRUENAS_API_KEY secret in Forgejo.

Next Steps

Once these bootstrap steps are complete, the foundational authentication is in place. The Forgejo CI actions will now have the necessary permissions to build images, provision VMs, and test staging environments autonomously and securely.

4.5 KiB Raw Blame History