Use artifactapi registry source for encapi provider

Seed encapi (statuses, roles, prodnxsr node assignments) and make the
instance module also create an encapi_node for every VM, so the k8s
puppetserver ENC can cut over from Cobbler. Cobbler/puppetca/puppetdb
resources are left untouched.

- Add config/encapi leaf + modules/encapi driving statuses/roles/nodes
  from YAML (3 statuses, 51 roles, 13 prodnxsr physical nodes).
- Add encapi_node to modules/instance (certname, role, environment).
- Wire encapi provider into root.hcl required_providers and the module
  providers; plumb ENCAPI_WRITE_TOKEN via Makefile vault_env.

.gitea/workflows/build.yaml

@@ -9,7 +9,7 @@ jobs:
     runs-on: almalinux-8
     container:
       image: git.unkin.net/unkin/almalinux9-actionsdind:latest
-      options: --privileged
+      options: "--privileged --volume /etc/pki/tls/vault:/etc/pki/tls/vault:ro"
 
     steps:
       - name: Checkout code
@@ -29,4 +29,5 @@ jobs:
         env:
           VAULT_ROLEID: ${{ secrets.TERRAFORM_INCUS_VAULT_ROLEID }}
         run: |
+          dnf install terraform -y
           make plan

.gitea/workflows/deploy.yaml

@@ -7,11 +7,11 @@ on:
       - master
 
 jobs:
-  build:
+  deploy:
     runs-on: almalinux-8
     container:
       image: git.unkin.net/unkin/almalinux9-actionsdind:latest
-      options: --privileged
+      options: "--privileged --volume /etc/pki/tls/vault:/etc/pki/tls/vault:ro"
 
     steps:
       - name: Checkout code
@@ -19,16 +19,9 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Fetch master branch
-        run: |
-          git fetch origin master:master
-
-      - name: Show changed files
-        run: |
-          git diff --name-only master
-
       - name: Run Terraform Apply
         env:
           VAULT_ROLEID: ${{ secrets.TERRAFORM_INCUS_VAULT_ROLEID }}
         run: |
+          dnf install terraform -y
           make apply

Makefile

@@ -10,6 +10,7 @@ define vault_env
 	export PUPPET_CERT_CA=$$(vault kv get -field=public_key kv/service/puppet/certificates/ca) && \
 	export PUPPET_CERT_PUB=$$(vault kv get -field=public_key kv/service/puppet/certificates/terraform) && \
 	export PUPPET_CERT_PRIV=$$(vault kv get -field=private_key kv/service/puppet/certificates/terraform) && \
+	export ENCAPI_WRITE_TOKEN=$$(vault kv get -field=ENCAPI_WRITE_TOKEN kv/kubernetes/namespace/encapi/default/environment) && \
 	export TG_QUEUE_EXCLUDE_DIR="templates/base" && \
 	export TG_PROVIDER_CACHE=1 && \
 	export TG_TF_PATH=terraform && \
@@ -18,8 +19,19 @@ define vault_env
 	export INCUS_CONFIG_DIR=$$(mktemp -d) && \
 	trap "rm -rf $$INCUS_CONFIG_DIR" EXIT && \
 	mkdir -p $$INCUS_CONFIG_DIR && \
-	printf '%s\n' "$$INCUS_CLIENT_CRT" > $$INCUS_CONFIG_DIR/client.crt && \
-	printf '%s\n' "$$INCUS_CLIENT_KEY" > $$INCUS_CONFIG_DIR/client.key
+	mkdir -p $$INCUS_CONFIG_DIR/servercerts && \
+	printf '%s\n' "$$INCUS_CONF_INCUSIMAGES_CERT" > $$INCUS_CONFIG_DIR/servercerts/incus-images.crt && \
+	printf '%s\n' "$$INCUS_CONF_CONFIG_YAML" > $$INCUS_CONFIG_DIR/config.yml && \
+	if [ -f /etc/pki/tls/vault/certificate.crt ] && [ -f /etc/pki/tls/vault/private.key ]; then \
+		cp /etc/pki/tls/vault/certificate.crt $$INCUS_CONFIG_DIR/client.crt && \
+		cp /etc/pki/tls/vault/private.key $$INCUS_CONFIG_DIR/client.key; \
+	elif [ -f $$HOME/.config/incus/client.crt ] && [ -f $$HOME/.config/incus/client.key ]; then \
+		cp $$HOME/.config/incus/client.crt $$INCUS_CONFIG_DIR/client.crt && \
+		cp $$HOME/.config/incus/client.key $$INCUS_CONFIG_DIR/client.key; \
+	else \
+		printf '%s\n' "$$INCUS_CLIENT_CRT" > $$INCUS_CONFIG_DIR/client.crt && \
+		printf '%s\n' "$$INCUS_CLIENT_KEY" > $$INCUS_CONFIG_DIR/client.key; \
+	fi
 endef
 
 clean:
@@ -35,11 +47,11 @@ init:
 
 plan: init
 	@$(call vault_env) && \
-	terragrunt run --all --parallelism 8 --non-interactive plan
+	terragrunt run --all --parallelism 4 --non-interactive plan
 
 apply: init
 	@$(call vault_env) && \
-	terragrunt run --all --parallelism 5 --non-interactive apply
+	terragrunt run --all --parallelism 2 --non-interactive apply
 
 output:
 	@$(call vault_env) && \

config/encapi/nodes.yaml

@@ -0,0 +1,44 @@
+# encapi node assignments for the 13 prodnxsr* physical nodes.
+# These hosts are NOT managed by the incus instance module (they are the
+# bare-metal hypervisors / k8s nodes), so they are seeded here explicitly.
+# certname -> role from the PuppetDB enc_role fact; environment=develop to
+# match their current catalog_environment.
+prodnxsr0001.main.unkin.net:
+  role: roles::infra::k8s::control
+  environment: develop
+prodnxsr0002.main.unkin.net:
+  role: roles::infra::k8s::control
+  environment: develop
+prodnxsr0003.main.unkin.net:
+  role: roles::infra::k8s::control
+  environment: develop
+prodnxsr0004.main.unkin.net:
+  role: roles::infra::k8s::compute
+  environment: develop
+prodnxsr0005.main.unkin.net:
+  role: roles::infra::k8s::compute
+  environment: develop
+prodnxsr0006.main.unkin.net:
+  role: roles::infra::k8s::compute
+  environment: develop
+prodnxsr0007.main.unkin.net:
+  role: roles::infra::k8s::compute
+  environment: develop
+prodnxsr0008.main.unkin.net:
+  role: roles::infra::k8s::compute
+  environment: develop
+prodnxsr0009.main.unkin.net:
+  role: roles::infra::incus::node
+  environment: develop
+prodnxsr0010.main.unkin.net:
+  role: roles::infra::incus::node
+  environment: develop
+prodnxsr0011.main.unkin.net:
+  role: roles::infra::incus::node
+  environment: develop
+prodnxsr0012.main.unkin.net:
+  role: roles::infra::incus::node
+  environment: develop
+prodnxsr0013.main.unkin.net:
+  role: roles::infra::incus::node
+  environment: develop

config/encapi/roles.yaml

@@ -0,0 +1,55 @@
+# encapi roles: every distinct Puppet role class used across
+# config/instances/*/config.yaml (cobbler_mgmt_classes[0]) PLUS the roles
+# run by the 13 prodnxsr physical nodes (from PuppetDB enc_role fact).
+# Values are empty maps; add description/default_params here when needed.
+roles::apps::jupyter::hub: {}
+roles::apps::media::jellyfin: {}
+roles::apps::media::lidarr: {}
+roles::apps::media::nzbget: {}
+roles::apps::media::prowlarr: {}
+roles::apps::media::radarr: {}
+roles::apps::media::readarr: {}
+roles::apps::media::sonarr: {}
+roles::apps::music::gonic: {}
+roles::base: {}
+roles::infra::auth::glauth: {}
+roles::infra::ceph::rgw: {}
+roles::infra::cobbler::server: {}
+roles::infra::dhcp::server: {}
+roles::infra::dns::externaldns: {}
+roles::infra::dns::master: {}
+roles::infra::dns::resolver: {}
+roles::infra::git::redis: {}
+roles::infra::git::runner: {}
+roles::infra::git::server: {}
+roles::infra::halb::haproxy2: {}
+roles::infra::incus::imagehost: {}
+roles::infra::incus::node: {}
+roles::infra::k8s::compute: {}
+roles::infra::k8s::control: {}
+roles::infra::logs::vlagent: {}
+roles::infra::logs::vlinsert: {}
+roles::infra::logs::vlselect: {}
+roles::infra::logs::vlstorage: {}
+roles::infra::mail::backend: {}
+roles::infra::mail::gateway: {}
+roles::infra::metrics::grafana: {}
+roles::infra::metrics::prometheus: {}
+roles::infra::metrics::vmagent: {}
+roles::infra::metrics::vminsert: {}
+roles::infra::metrics::vmselect: {}
+roles::infra::metrics::vmstorage: {}
+roles::infra::nomad::agentv2: {}
+roles::infra::nomad::server: {}
+roles::infra::pki::certbot: {}
+roles::infra::proxy::jumphost: {}
+roles::infra::puppetboard::server: {}
+roles::infra::puppetdb::api: {}
+roles::infra::puppetdb::sql: {}
+roles::infra::puppet::master: {}
+roles::infra::reposync::repo: {}
+roles::infra::reposync::syncer: {}
+roles::infra::sql::shared: {}
+roles::infra::storage::consul: {}
+roles::infra::storage::edgecache: {}
+roles::infra::storage::vault: {}

config/encapi/statuses.yaml

@@ -0,0 +1,10 @@
+# encapi statuses == Puppet environments (Cobbler "status").
+# Seeded from what the estate actually runs (all nodes today report
+# catalog_environment=develop) plus production (the environment the incus
+# instance module pins via puppetca_certificate) and testing (implicit).
+production:
+  description: Production environment
+develop:
+  description: Development environment (current default across the estate)
+testing:
+  description: Implicit/transient environment

config/encapi/terragrunt.hcl

@@ -0,0 +1,19 @@
+locals {
+  statuses = yamldecode(file("${get_terragrunt_dir()}/statuses.yaml"))
+  roles    = yamldecode(file("${get_terragrunt_dir()}/roles.yaml"))
+  nodes    = yamldecode(file("${get_terragrunt_dir()}/nodes.yaml"))
+}
+
+include "root" {
+  path = find_in_parent_folders("root.hcl")
+}
+
+terraform {
+  source = "${get_repo_root()}/modules/encapi"
+}
+
+inputs = {
+  statuses = local.statuses
+  roles    = local.roles
+  nodes    = local.nodes
+}

config/globals/profiles.yaml

@@ -159,6 +159,16 @@ shared_apps_jellyfin:
       properties:
         source: /shared/apps/jellyfin
         path: /shared/apps/jellyfin
+shared_apps_maildata:
+  description: "Mount /shared/apps/maildata directly into the container"
+  project: null
+  config: {}
+  devices:
+    - type: disk
+      name: maildata-shared
+      properties:
+        source: /shared/apps/maildata
+        path: /shared/apps/maildata
 
 # storage
 disk10:

config/instances/ausyd1nxvm2065/config.yaml

@@ -10,4 +10,4 @@ storage_volumes:
     pool: fastpool
     path: /data
     config:
-      size: 50GB
+      size: 100GB

config/instances/ausyd1nxvm2066/config.yaml

@@ -10,4 +10,4 @@ storage_volumes:
     pool: fastpool
     path: /data
     config:
-      size: 50GB
+      size: 100GB

config/instances/ausyd1nxvm2067/config.yaml

@@ -10,4 +10,4 @@ storage_volumes:
     pool: fastpool
     path: /data
     config:
-      size: 50GB
+      size: 100GB

config/instances/ausyd1nxvm2120/config.yaml

@@ -0,0 +1,7 @@
+description: TestHost
+cobbler_mgmt_classes:
+  - roles::base
+profiles:
+  - disk10
+  - net_com1_eth0
+  - 2core4096

config/instances/ausyd1nxvm2120/terragrunt.hcl

@@ -0,0 +1,54 @@
+locals {
+  node_name     = "prodnxsr0013"
+  config_common     = yamldecode(file("${get_terragrunt_dir()}/../config_common.yaml"))
+  config_specific   = yamldecode(file("${get_terragrunt_dir()}/config.yaml"))
+  config            = merge(local.config_common, local.config_specific)
+  instance_name     = basename(get_terragrunt_dir())
+}
+
+inputs = merge(
+  {
+    name = local.instance_name
+  },
+  local.config
+)
+
+include "root" {
+  path   = find_in_parent_folders("root.hcl")
+}
+
+include "instances" {
+  path   = find_in_parent_folders("instances.hcl")
+  expose = true
+  merge_strategy = "deep"
+}
+
+dependencies {
+  paths = ["${get_repo_root()}/config/nodes/${local.node_name}"]
+}
+
+
+generate "incus" {
+  path      = "incus.tf"
+  if_exists = "overwrite_terragrunt"
+  contents  = <<-EOF
+    provider "incus" {
+      generate_client_certificates = false
+      accept_remote_certificate    = true
+      config_dir = "${get_env("INCUS_CONFIG_DIR")}"
+
+      remote {
+        name    = "${basename(get_terragrunt_dir())}"
+        scheme  = "https"
+        address = "${yamldecode(file("${get_repo_root()}/config/nodes/${local.node_name}/config.yaml")).node_addr}"
+        port    = "${yamldecode(file("${get_repo_root()}/config/nodes/${local.node_name}/config.yaml")).node_port}"
+        token   = "${get_env("INCUS_TOKEN_${upper(local.node_name)}")}"
+        default = true
+      }
+    }
+  EOF
+}
+terraform {
+  source = "${get_repo_root()}/modules/instance"
+}
+

config/instances/ausyd1nxvm2121/config.yaml

@@ -0,0 +1,7 @@
+description: Postfix MTA
+cobbler_mgmt_classes:
+  - roles::infra::mail::gateway
+profiles:
+  - disk20
+  - net_dmz1_eth0
+  - 2core4096

config/instances/ausyd1nxvm2121/terragrunt.hcl

@@ -0,0 +1,54 @@
+locals {
+  node_name     = "prodnxsr0009"
+  config_common     = yamldecode(file("${get_terragrunt_dir()}/../config_common.yaml"))
+  config_specific   = yamldecode(file("${get_terragrunt_dir()}/config.yaml"))
+  config            = merge(local.config_common, local.config_specific)
+  instance_name     = basename(get_terragrunt_dir())
+}
+
+inputs = merge(
+  {
+    name = local.instance_name
+  },
+  local.config
+)
+
+include "root" {
+  path   = find_in_parent_folders("root.hcl")
+}
+
+include "instances" {
+  path   = find_in_parent_folders("instances.hcl")
+  expose = true
+  merge_strategy = "deep"
+}
+
+dependencies {
+  paths = ["${get_repo_root()}/config/nodes/${local.node_name}"]
+}
+
+
+generate "incus" {
+  path      = "incus.tf"
+  if_exists = "overwrite_terragrunt"
+  contents  = <<-EOF
+    provider "incus" {
+      generate_client_certificates = false
+      accept_remote_certificate    = true
+      config_dir = "${get_env("INCUS_CONFIG_DIR")}"
+
+      remote {
+        name    = "${basename(get_terragrunt_dir())}"
+        scheme  = "https"
+        address = "${yamldecode(file("${get_repo_root()}/config/nodes/${local.node_name}/config.yaml")).node_addr}"
+        port    = "${yamldecode(file("${get_repo_root()}/config/nodes/${local.node_name}/config.yaml")).node_port}"
+        token   = "${get_env("INCUS_TOKEN_${upper(local.node_name)}")}"
+        default = true
+      }
+    }
+  EOF
+}
+terraform {
+  source = "${get_repo_root()}/modules/instance"
+}
+

config/instances/ausyd1nxvm2122/config.yaml

@@ -0,0 +1,7 @@
+description: Postfix MTA
+cobbler_mgmt_classes:
+  - roles::infra::mail::gateway
+profiles:
+  - disk20
+  - net_dmz1_eth0
+  - 2core4096

config/instances/ausyd1nxvm2122/terragrunt.hcl

@@ -0,0 +1,54 @@
+locals {
+  node_name     = "prodnxsr0010"
+  config_common     = yamldecode(file("${get_terragrunt_dir()}/../config_common.yaml"))
+  config_specific   = yamldecode(file("${get_terragrunt_dir()}/config.yaml"))
+  config            = merge(local.config_common, local.config_specific)
+  instance_name     = basename(get_terragrunt_dir())
+}
+
+inputs = merge(
+  {
+    name = local.instance_name
+  },
+  local.config
+)
+
+include "root" {
+  path   = find_in_parent_folders("root.hcl")
+}
+
+include "instances" {
+  path   = find_in_parent_folders("instances.hcl")
+  expose = true
+  merge_strategy = "deep"
+}
+
+dependencies {
+  paths = ["${get_repo_root()}/config/nodes/${local.node_name}"]
+}
+
+
+generate "incus" {
+  path      = "incus.tf"
+  if_exists = "overwrite_terragrunt"
+  contents  = <<-EOF
+    provider "incus" {
+      generate_client_certificates = false
+      accept_remote_certificate    = true
+      config_dir = "${get_env("INCUS_CONFIG_DIR")}"
+
+      remote {
+        name    = "${basename(get_terragrunt_dir())}"
+        scheme  = "https"
+        address = "${yamldecode(file("${get_repo_root()}/config/nodes/${local.node_name}/config.yaml")).node_addr}"
+        port    = "${yamldecode(file("${get_repo_root()}/config/nodes/${local.node_name}/config.yaml")).node_port}"
+        token   = "${get_env("INCUS_TOKEN_${upper(local.node_name)}")}"
+        default = true
+      }
+    }
+  EOF
+}
+terraform {
+  source = "${get_repo_root()}/modules/instance"
+}
+

config/instances/ausyd1nxvm2123/config.yaml

@@ -0,0 +1,7 @@
+description: Postfix MTA
+cobbler_mgmt_classes:
+  - roles::infra::mail::gateway
+profiles:
+  - disk20
+  - net_dmz1_eth0
+  - 2core4096

config/instances/ausyd1nxvm2123/terragrunt.hcl

@@ -0,0 +1,54 @@
+locals {
+  node_name     = "prodnxsr0011"
+  config_common     = yamldecode(file("${get_terragrunt_dir()}/../config_common.yaml"))
+  config_specific   = yamldecode(file("${get_terragrunt_dir()}/config.yaml"))
+  config            = merge(local.config_common, local.config_specific)
+  instance_name     = basename(get_terragrunt_dir())
+}
+
+inputs = merge(
+  {
+    name = local.instance_name
+  },
+  local.config
+)
+
+include "root" {
+  path   = find_in_parent_folders("root.hcl")
+}
+
+include "instances" {
+  path   = find_in_parent_folders("instances.hcl")
+  expose = true
+  merge_strategy = "deep"
+}
+
+dependencies {
+  paths = ["${get_repo_root()}/config/nodes/${local.node_name}"]
+}
+
+
+generate "incus" {
+  path      = "incus.tf"
+  if_exists = "overwrite_terragrunt"
+  contents  = <<-EOF
+    provider "incus" {
+      generate_client_certificates = false
+      accept_remote_certificate    = true
+      config_dir = "${get_env("INCUS_CONFIG_DIR")}"
+
+      remote {
+        name    = "${basename(get_terragrunt_dir())}"
+        scheme  = "https"
+        address = "${yamldecode(file("${get_repo_root()}/config/nodes/${local.node_name}/config.yaml")).node_addr}"
+        port    = "${yamldecode(file("${get_repo_root()}/config/nodes/${local.node_name}/config.yaml")).node_port}"
+        token   = "${get_env("INCUS_TOKEN_${upper(local.node_name)}")}"
+        default = true
+      }
+    }
+  EOF
+}
+terraform {
+  source = "${get_repo_root()}/modules/instance"
+}
+

config/instances/ausyd1nxvm2124/config.yaml

@@ -0,0 +1,8 @@
+description: Dovecot Backend
+cobbler_mgmt_classes:
+  - roles::infra::mail::backend
+profiles:
+  - disk20
+  - net_com1_eth0
+  - 2core4096
+  - shared_apps_maildata

config/instances/ausyd1nxvm2124/terragrunt.hcl

@@ -0,0 +1,54 @@
+locals {
+  node_name     = "prodnxsr0012"
+  config_common     = yamldecode(file("${get_terragrunt_dir()}/../config_common.yaml"))
+  config_specific   = yamldecode(file("${get_terragrunt_dir()}/config.yaml"))
+  config            = merge(local.config_common, local.config_specific)
+  instance_name     = basename(get_terragrunt_dir())
+}
+
+inputs = merge(
+  {
+    name = local.instance_name
+  },
+  local.config
+)
+
+include "root" {
+  path   = find_in_parent_folders("root.hcl")
+}
+
+include "instances" {
+  path   = find_in_parent_folders("instances.hcl")
+  expose = true
+  merge_strategy = "deep"
+}
+
+dependencies {
+  paths = ["${get_repo_root()}/config/nodes/${local.node_name}"]
+}
+
+
+generate "incus" {
+  path      = "incus.tf"
+  if_exists = "overwrite_terragrunt"
+  contents  = <<-EOF
+    provider "incus" {
+      generate_client_certificates = false
+      accept_remote_certificate    = true
+      config_dir = "${get_env("INCUS_CONFIG_DIR")}"
+
+      remote {
+        name    = "${basename(get_terragrunt_dir())}"
+        scheme  = "https"
+        address = "${yamldecode(file("${get_repo_root()}/config/nodes/${local.node_name}/config.yaml")).node_addr}"
+        port    = "${yamldecode(file("${get_repo_root()}/config/nodes/${local.node_name}/config.yaml")).node_port}"
+        token   = "${get_env("INCUS_TOKEN_${upper(local.node_name)}")}"
+        default = true
+      }
+    }
+  EOF
+}
+terraform {
+  source = "${get_repo_root()}/modules/instance"
+}
+

config/instances/ausyd1nxvm2125/config.yaml

@@ -0,0 +1,8 @@
+description: Dovecot Backend
+cobbler_mgmt_classes:
+  - roles::infra::mail::backend
+profiles:
+  - disk20
+  - net_com1_eth0
+  - 2core4096
+  - shared_apps_maildata

config/instances/ausyd1nxvm2125/terragrunt.hcl

@@ -0,0 +1,54 @@
+locals {
+  node_name     = "prodnxsr0013"
+  config_common     = yamldecode(file("${get_terragrunt_dir()}/../config_common.yaml"))
+  config_specific   = yamldecode(file("${get_terragrunt_dir()}/config.yaml"))
+  config            = merge(local.config_common, local.config_specific)
+  instance_name     = basename(get_terragrunt_dir())
+}
+
+inputs = merge(
+  {
+    name = local.instance_name
+  },
+  local.config
+)
+
+include "root" {
+  path   = find_in_parent_folders("root.hcl")
+}
+
+include "instances" {
+  path   = find_in_parent_folders("instances.hcl")
+  expose = true
+  merge_strategy = "deep"
+}
+
+dependencies {
+  paths = ["${get_repo_root()}/config/nodes/${local.node_name}"]
+}
+
+
+generate "incus" {
+  path      = "incus.tf"
+  if_exists = "overwrite_terragrunt"
+  contents  = <<-EOF
+    provider "incus" {
+      generate_client_certificates = false
+      accept_remote_certificate    = true
+      config_dir = "${get_env("INCUS_CONFIG_DIR")}"
+
+      remote {
+        name    = "${basename(get_terragrunt_dir())}"
+        scheme  = "https"
+        address = "${yamldecode(file("${get_repo_root()}/config/nodes/${local.node_name}/config.yaml")).node_addr}"
+        port    = "${yamldecode(file("${get_repo_root()}/config/nodes/${local.node_name}/config.yaml")).node_port}"
+        token   = "${get_env("INCUS_TOKEN_${upper(local.node_name)}")}"
+        default = true
+      }
+    }
+  EOF
+}
+terraform {
+  source = "${get_repo_root()}/modules/instance"
+}
+

config/instances/ausyd1nxvm2126/config.yaml

@@ -0,0 +1,8 @@
+description: Dovecot Backend
+cobbler_mgmt_classes:
+  - roles::infra::mail::backend
+profiles:
+  - disk20
+  - net_com1_eth0
+  - 2core4096
+  - shared_apps_maildata

config/instances/ausyd1nxvm2126/terragrunt.hcl

@@ -0,0 +1,54 @@
+locals {
+  node_name     = "prodnxsr0009"
+  config_common     = yamldecode(file("${get_terragrunt_dir()}/../config_common.yaml"))
+  config_specific   = yamldecode(file("${get_terragrunt_dir()}/config.yaml"))
+  config            = merge(local.config_common, local.config_specific)
+  instance_name     = basename(get_terragrunt_dir())
+}
+
+inputs = merge(
+  {
+    name = local.instance_name
+  },
+  local.config
+)
+
+include "root" {
+  path   = find_in_parent_folders("root.hcl")
+}
+
+include "instances" {
+  path   = find_in_parent_folders("instances.hcl")
+  expose = true
+  merge_strategy = "deep"
+}
+
+dependencies {
+  paths = ["${get_repo_root()}/config/nodes/${local.node_name}"]
+}
+
+
+generate "incus" {
+  path      = "incus.tf"
+  if_exists = "overwrite_terragrunt"
+  contents  = <<-EOF
+    provider "incus" {
+      generate_client_certificates = false
+      accept_remote_certificate    = true
+      config_dir = "${get_env("INCUS_CONFIG_DIR")}"
+
+      remote {
+        name    = "${basename(get_terragrunt_dir())}"
+        scheme  = "https"
+        address = "${yamldecode(file("${get_repo_root()}/config/nodes/${local.node_name}/config.yaml")).node_addr}"
+        port    = "${yamldecode(file("${get_repo_root()}/config/nodes/${local.node_name}/config.yaml")).node_port}"
+        token   = "${get_env("INCUS_TOKEN_${upper(local.node_name)}")}"
+        default = true
+      }
+    }
+  EOF
+}
+terraform {
+  source = "${get_repo_root()}/modules/instance"
+}
+

config/instances/ausyd1nxvm2127/config.yaml

@@ -0,0 +1,7 @@
+description: ExternalDNS For K8S
+cobbler_mgmt_classes:
+  - roles::infra::dns::externaldns
+profiles:
+  - disk20
+  - net_com1_eth0
+  - 2core3072

config/instances/ausyd1nxvm2127/terragrunt.hcl

@@ -0,0 +1,54 @@
+locals {
+  node_name     = "prodnxsr0010"
+  config_common     = yamldecode(file("${get_terragrunt_dir()}/../config_common.yaml"))
+  config_specific   = yamldecode(file("${get_terragrunt_dir()}/config.yaml"))
+  config            = merge(local.config_common, local.config_specific)
+  instance_name     = basename(get_terragrunt_dir())
+}
+
+inputs = merge(
+  {
+    name = local.instance_name
+  },
+  local.config
+)
+
+include "root" {
+  path   = find_in_parent_folders("root.hcl")
+}
+
+include "instances" {
+  path   = find_in_parent_folders("instances.hcl")
+  expose = true
+  merge_strategy = "deep"
+}
+
+dependencies {
+  paths = ["${get_repo_root()}/config/nodes/${local.node_name}"]
+}
+
+
+generate "incus" {
+  path      = "incus.tf"
+  if_exists = "overwrite_terragrunt"
+  contents  = <<-EOF
+    provider "incus" {
+      generate_client_certificates = false
+      accept_remote_certificate    = true
+      config_dir = "${get_env("INCUS_CONFIG_DIR")}"
+
+      remote {
+        name    = "${basename(get_terragrunt_dir())}"
+        scheme  = "https"
+        address = "${yamldecode(file("${get_repo_root()}/config/nodes/${local.node_name}/config.yaml")).node_addr}"
+        port    = "${yamldecode(file("${get_repo_root()}/config/nodes/${local.node_name}/config.yaml")).node_port}"
+        token   = "${get_env("INCUS_TOKEN_${upper(local.node_name)}")}"
+        default = true
+      }
+    }
+  EOF
+}
+terraform {
+  source = "${get_repo_root()}/modules/instance"
+}
+

config/instances/ausyd1nxvm2128/config.yaml

@@ -0,0 +1,7 @@
+description: ExternalDNS For K8S
+cobbler_mgmt_classes:
+  - roles::infra::dns::externaldns
+profiles:
+  - disk20
+  - net_com1_eth0
+  - 2core3072

config/instances/ausyd1nxvm2128/terragrunt.hcl

@@ -0,0 +1,54 @@
+locals {
+  node_name     = "prodnxsr0011"
+  config_common     = yamldecode(file("${get_terragrunt_dir()}/../config_common.yaml"))
+  config_specific   = yamldecode(file("${get_terragrunt_dir()}/config.yaml"))
+  config            = merge(local.config_common, local.config_specific)
+  instance_name     = basename(get_terragrunt_dir())
+}
+
+inputs = merge(
+  {
+    name = local.instance_name
+  },
+  local.config
+)
+
+include "root" {
+  path   = find_in_parent_folders("root.hcl")
+}
+
+include "instances" {
+  path   = find_in_parent_folders("instances.hcl")
+  expose = true
+  merge_strategy = "deep"
+}
+
+dependencies {
+  paths = ["${get_repo_root()}/config/nodes/${local.node_name}"]
+}
+
+
+generate "incus" {
+  path      = "incus.tf"
+  if_exists = "overwrite_terragrunt"
+  contents  = <<-EOF
+    provider "incus" {
+      generate_client_certificates = false
+      accept_remote_certificate    = true
+      config_dir = "${get_env("INCUS_CONFIG_DIR")}"
+
+      remote {
+        name    = "${basename(get_terragrunt_dir())}"
+        scheme  = "https"
+        address = "${yamldecode(file("${get_repo_root()}/config/nodes/${local.node_name}/config.yaml")).node_addr}"
+        port    = "${yamldecode(file("${get_repo_root()}/config/nodes/${local.node_name}/config.yaml")).node_port}"
+        token   = "${get_env("INCUS_TOKEN_${upper(local.node_name)}")}"
+        default = true
+      }
+    }
+  EOF
+}
+terraform {
+  source = "${get_repo_root()}/modules/instance"
+}
+

config/instances/ausyd1nxvm2129/config.yaml

@@ -0,0 +1,7 @@
+description: ExternalDNS For K8S
+cobbler_mgmt_classes:
+  - roles::infra::dns::externaldns
+profiles:
+  - disk20
+  - net_com1_eth0
+  - 2core3072

config/instances/ausyd1nxvm2129/terragrunt.hcl

@@ -0,0 +1,54 @@
+locals {
+  node_name     = "prodnxsr0012"
+  config_common     = yamldecode(file("${get_terragrunt_dir()}/../config_common.yaml"))
+  config_specific   = yamldecode(file("${get_terragrunt_dir()}/config.yaml"))
+  config            = merge(local.config_common, local.config_specific)
+  instance_name     = basename(get_terragrunt_dir())
+}
+
+inputs = merge(
+  {
+    name = local.instance_name
+  },
+  local.config
+)
+
+include "root" {
+  path   = find_in_parent_folders("root.hcl")
+}
+
+include "instances" {
+  path   = find_in_parent_folders("instances.hcl")
+  expose = true
+  merge_strategy = "deep"
+}
+
+dependencies {
+  paths = ["${get_repo_root()}/config/nodes/${local.node_name}"]
+}
+
+
+generate "incus" {
+  path      = "incus.tf"
+  if_exists = "overwrite_terragrunt"
+  contents  = <<-EOF
+    provider "incus" {
+      generate_client_certificates = false
+      accept_remote_certificate    = true
+      config_dir = "${get_env("INCUS_CONFIG_DIR")}"
+
+      remote {
+        name    = "${basename(get_terragrunt_dir())}"
+        scheme  = "https"
+        address = "${yamldecode(file("${get_repo_root()}/config/nodes/${local.node_name}/config.yaml")).node_addr}"
+        port    = "${yamldecode(file("${get_repo_root()}/config/nodes/${local.node_name}/config.yaml")).node_port}"
+        token   = "${get_env("INCUS_TOKEN_${upper(local.node_name)}")}"
+        default = true
+      }
+    }
+  EOF
+}
+terraform {
+  source = "${get_repo_root()}/modules/instance"
+}
+

config/root.hcl

@@ -26,7 +26,7 @@ inputs = {
 generate "backend" {
   path      = "backend.tf"
   if_exists = "overwrite_terragrunt"
-  contents = <<EOF
+  contents  = <<EOF
 terraform {
   required_providers {
     vault = {
@@ -49,6 +49,10 @@ terraform {
       source = "camptocamp/puppetdb"
       version = "2.0.0"
     }
+    encapi = {
+      source  = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/encapi"
+      version = "0.1.0"
+    }
   }
   backend "consul" {
     address = "${local.consul_addr}"

modules/encapi/main.tf

@@ -0,0 +1,29 @@
+resource "encapi_status" "this" {
+  for_each = var.statuses
+
+  name        = each.key
+  description = each.value.description
+}
+
+resource "encapi_role" "this" {
+  for_each = var.roles
+
+  name           = each.key
+  description    = each.value.description
+  default_params = each.value.default_params == null ? null : jsonencode(each.value.default_params)
+}
+
+resource "encapi_node" "this" {
+  for_each = var.nodes
+
+  certname    = each.key
+  role        = each.value.role
+  environment = each.value.environment
+  params      = each.value.params == null ? null : jsonencode(each.value.params)
+
+  # Nodes FK-require their role and status to exist first.
+  depends_on = [
+    encapi_role.this,
+    encapi_status.this,
+  ]
+}

modules/encapi/providers.tf

@@ -0,0 +1,10 @@
+provider "encapi" {
+  endpoint = var.encapi_endpoint
+  # token defaults to the ENCAPI_WRITE_TOKEN environment variable
+}
+
+variable "encapi_endpoint" {
+  description = "The encapi server base URL."
+  type        = string
+  default     = "https://encapi.k8s.syd1.au.unkin.net"
+}

modules/encapi/variables.tf

@@ -0,0 +1,37 @@
+variable "statuses" {
+  description = <<EOT
+Map of encapi statuses (Puppet environments) to seed. Keyed by status name.
+Each value may carry an optional description.
+EOT
+  type = map(object({
+    description = optional(string)
+  }))
+  default = {}
+}
+
+variable "roles" {
+  description = <<EOT
+Map of encapi roles to seed. Keyed by role class name (e.g. roles::base).
+Each value may carry an optional description and a default_params object that
+is jsonencode()'d into the role's inheritable defaults.
+EOT
+  type = map(object({
+    description    = optional(string)
+    default_params = optional(any)
+  }))
+  default = {}
+}
+
+variable "nodes" {
+  description = <<EOT
+Map of encapi node assignments to seed. Keyed by certname. Each value pins the
+node to a role and environment (which must exist as a role/status above), with
+optional per-node params jsonencode()'d into the ENC output.
+EOT
+  type = map(object({
+    role        = string
+    environment = string
+    params      = optional(any)
+  }))
+  default = {}
+}

modules/encapi/versions.tf

@@ -0,0 +1,8 @@
+terraform {
+  required_providers {
+    encapi = {
+      source  = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/encapi"
+      version = "0.1.0"
+    }
+  }
+}

modules/instance/main.tf

@@ -97,6 +97,17 @@ resource "puppetdb_node" "this" {
   depends_on = [incus_instance.this]
 }
 
+# Dual-write the ENC assignment into encapi alongside the Cobbler system above.
+# The role and environment must already exist in encapi (seeded by the
+# config/encapi leaf); apply that leaf before the instance leaves.
+resource "encapi_node" "this" {
+  certname    = "${var.name}.${var.cobbler_domain}"
+  role        = var.cobbler_mgmt_classes[0]
+  environment = var.encapi_environment
+
+  depends_on = [incus_instance.this]
+}
+
 resource "null_resource" "wait_for_instance_ready" {
   depends_on = [incus_instance.this]
 

modules/instance/providers.tf

@@ -17,3 +17,8 @@ provider "puppetca" {
   cert = var.puppet_cert_pub
   key  = var.puppet_cert_priv
 }
+
+provider "encapi" {
+  endpoint = var.encapi_endpoint
+  # token defaults to the ENCAPI_WRITE_TOKEN environment variable
+}

modules/instance/variables.tf

@@ -170,3 +170,18 @@ variable "check_on_instance_creation" {
   type        = bool
   default     = false
 }
+
+variable "encapi_endpoint" {
+  description = "The encapi server base URL."
+  type        = string
+  default     = "https://encapi.k8s.syd1.au.unkin.net"
+}
+
+variable "encapi_environment" {
+  description = <<EOT
+Environment (encapi_status) to pin this instance to in encapi. Defaults to
+"production" to match the environment used by puppetca_certificate today.
+EOT
+  type        = string
+  default     = "production"
+}