Magicar Infra

Infrastructure for Magicar services.

This repo provisions Google Cloud infrastructure with OpenTofu and manages the NixOS services running on the shared VM. Windmill and Magi-Chan currently run on that server as Quadlet-managed Podman containers.

Model

The split is deliberate:

• OpenTofu owns slow-moving cloud infrastructure: the VM, firewall rules, disk, static IP, region, Secret Manager containers, and IAM access.
• Nix owns server state: system packages, Podman/Quadlet, systemd units, Caddy, service containers, resource limits, and rollouts.
• Day-two service deploys use scripts/deploy, not tofu apply.

Use OpenTofu when changing cloud shape. Use Nix when changing what runs on the server.

Layout

infra/              OpenTofu configuration for Google Cloud resources
hosts/              NixOS host profiles and base image configuration
modules/            NixOS modules for services
scripts/            Image build, deploy, and secret helpers
docs/               Service-specific and bootstrap docs

Development

Make changes locally, validate them, then deploy either from your machine or by pushing to GitHub and triggering a workflow.

nix --extra-experimental-features nix-command --extra-experimental-features flakes flake check --no-build
tofu -chdir=infra fmt -check
tofu -chdir=infra validate

Use OpenTofu for cloud-shape changes:

tofu -chdir=infra plan
tofu -chdir=infra apply

Use Nix for host and service rollouts:

./scripts/deploy

Examples of Nix-owned changes:

• Add a service module under modules/.
• Enable a service from a host profile under hosts/.
• Pin or update container images.
• Change Caddy hostnames after pointing DNS at the VM.
• Add or adjust Quadlet-managed Podman containers.
• Raise memory/CPU limits if the VM size changes.

Examples of OpenTofu-owned changes:

• Resize the VM.
• Change firewall rules.
• Add IAM bindings.
• Add Secret Manager containers.
• Change the static IP, region, zone, or disk shape.

GitHub Flow

Commit and push:

jj describe -m "Your change"
jj bookmark set main -r @
jj git push --bookmark main

CI runs automatically on push. For a Nix service rollout from GitHub:

gh workflow run deploy-apps.yml
gh run watch

For a full host rollout:

gh workflow run deploy-nixos.yml

For OpenTofu:

gh workflow run deploy-tofu.yml
gh workflow run deploy-tofu.yml -f mode=apply

The workflow defaults target team-ops-automation, us-west1-a, windmill-cheap, and .#windmill-cheap. Pass -f values only when deploying somewhere else.

GitHub deploys authenticate to GCP with Workload Identity Federation. OpenTofu manages that identity setup, and OpenTofu state is stored in the GCS bucket configured in infra/backend.tf.

Service Docs

• Windmill
• Magi-Chan Bot

Bootstrap

Most work should not need bootstrap steps. For a brand-new GCP project, fresh NixOS image, GitHub Actions setup, local CI impersonation, or destroy flow, see Bootstrap.