data "openstack_images_image_v2" "os" {
  name        = var.image_name
  most_recent = true
}

data "openstack_networking_network_v2" "external" {
  name = var.external_network
}

resource "openstack_networking_network_v2" "private" {
  name           = "dev-env-private"
  admin_state_up = true
}

resource "openstack_networking_subnet_v2" "private" {
  name            = "dev-env-private-subnet"
  network_id      = openstack_networking_network_v2.private.id
  cidr            = var.private_cidr
  ip_version      = 4
  dns_nameservers = ["1.1.1.1", "8.8.8.8"]
}

locals {
  # dev[0] holds the shared volume and serves it over NFS at a deterministic
  # address so the bastion and the other dev VMs can mount it without discovery.
  nfs_server_ip = cidrhost(var.private_cidr, 10)
}

resource "openstack_networking_router_v2" "dev" {
  name                = "dev-env-router"
  external_network_id = data.openstack_networking_network_v2.external.id
}

resource "openstack_networking_router_interface_v2" "private" {
  router_id = openstack_networking_router_v2.dev.id
  subnet_id = openstack_networking_subnet_v2.private.id
}

resource "openstack_networking_secgroup_v2" "bastion" {
  name        = "dev-env-bastion-sg"
  description = "SSH from all sources"
}

resource "openstack_networking_secgroup_rule_v2" "bastion_ssh" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 22
  port_range_max    = 22
  remote_ip_prefix  = "0.0.0.0/0"
  security_group_id = openstack_networking_secgroup_v2.bastion.id
}

resource "openstack_networking_secgroup_v2" "dev" {
  name        = "dev-env-dev-sg"
  description = "SSH and internal traffic from the private subnet"
}

resource "openstack_networking_secgroup_rule_v2" "dev_ssh" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 22
  port_range_max    = 22
  remote_ip_prefix  = var.private_cidr
  security_group_id = openstack_networking_secgroup_v2.dev.id
}

resource "openstack_networking_secgroup_rule_v2" "dev_internal" {
  direction         = "ingress"
  ethertype         = "IPv4"
  remote_ip_prefix  = var.private_cidr
  security_group_id = openstack_networking_secgroup_v2.dev.id
}


resource "openstack_compute_instance_v2" "bastion" {
  name        = "dev-env-bastion"
  flavor_name = var.bastion_flavor
  key_pair    = var.key_name

  user_data = templatefile("${path.module}/cloud-init/nfs-client.yaml", {
    nfs_server_ip = local.nfs_server_ip
    dev_tools     = var.dev_tools
  })

  block_device {
    uuid                  = data.openstack_images_image_v2.os.id
    source_type           = "image"
    destination_type      = "volume"
    volume_size           = 20
    boot_index            = 0
    delete_on_termination = true
  }

  network {
    port = openstack_networking_port_v2.bastion.id
  }
}

resource "openstack_networking_port_v2" "bastion" {
  name               = "dev-env-bastion-port"
  network_id         = openstack_networking_network_v2.private.id
  security_group_ids = [openstack_networking_secgroup_v2.bastion.id]

  fixed_ip {
    subnet_id = openstack_networking_subnet_v2.private.id
  }

  depends_on = [openstack_networking_router_interface_v2.private]
}

resource "openstack_networking_floatingip_v2" "bastion" {
  pool = var.external_network
}

resource "openstack_networking_floatingip_associate_v2" "bastion" {
  floating_ip = openstack_networking_floatingip_v2.bastion.address
  port_id     = openstack_networking_port_v2.bastion.id
}

resource "openstack_networking_port_v2" "dev" {
  count = var.dev_vm_count

  name               = "dev-env-dev-${count.index + 1}-port"
  network_id         = openstack_networking_network_v2.private.id
  security_group_ids = [openstack_networking_secgroup_v2.dev.id]

  fixed_ip {
    subnet_id  = openstack_networking_subnet_v2.private.id
    ip_address = cidrhost(var.private_cidr, 10 + count.index)
  }

  depends_on = [openstack_networking_router_interface_v2.private]
}

resource "openstack_compute_instance_v2" "dev" {
  count = var.dev_vm_count

  name        = "dev-env-dev-${count.index + 1}"
  flavor_name = var.flavor_name
  key_pair    = var.key_name

  # dev[0] formats and mounts the shared volume and exports it over NFS; the
  # remaining dev VMs mount that export, so the volume is shared across instances.
  user_data = count.index == 0 ? templatefile("${path.module}/cloud-init/nfs-server.yaml", {
    private_cidr = var.private_cidr
    dev_tools    = var.dev_tools
    }) : templatefile("${path.module}/cloud-init/nfs-client.yaml", {
    nfs_server_ip = local.nfs_server_ip
    dev_tools     = var.dev_tools
  })

  block_device {
    uuid                  = data.openstack_images_image_v2.os.id
    source_type           = "image"
    destination_type      = "volume"
    volume_size           = 20
    boot_index            = 0
    delete_on_termination = true
  }

  network {
    port = openstack_networking_port_v2.dev[count.index].id
  }
}

resource "openstack_blockstorage_volume_v3" "shared" {
  name = "dev-env-shared"
  size = var.shared_volume_size
}

resource "openstack_compute_volume_attach_v2" "shared_nfs" {
  instance_id = openstack_compute_instance_v2.dev[0].id
  volume_id   = openstack_blockstorage_volume_v3.shared.id
}

variable "dev_vm_count" {
  type        = number
  description = "Number of development virtual machines."
  default     = 2
}

variable "flavor_name" {
  type        = string
  description = "Flavor name for each development VM."
  default     = "s1a.medium"
}

variable "shared_volume_size" {
  type        = number
  description = "Size of the shared block volume in gigabytes."
  default     = 100
}

variable "image_name" {
  type        = string
  description = "Boot image name."
  default     = "Ubuntu-24.04"
}

variable "dev_tools" {
  type        = list(string)
  description = "Development packages installed on every instance via cloud-init."
  default     = ["build-essential", "git", "curl", "wget", "vim", "python3", "python3-pip", "jq", "unzip", "tmux"]
}

variable "key_name" {
  type        = string
  description = "Existing SSH keypair name in the project for compute instances"
}

variable "external_network" {
  description = "Shared external network for router gateway and floating IPs; defaults to PublicEphemeral (quickstart-aligned). Set PublicStatic in tfvars for a persisted floating IP."
  type        = string
  default     = "PublicEphemeral"
}

variable "private_cidr" {
  type        = string
  description = "IPv4 CIDR for the private tenant network."
  default     = "192.168.30.0/24"
}

variable "bastion_flavor" {
  type        = string
  description = "Flavor name for the bastion instance."
  default     = "s1a.small"
}

output "bastion_ip" {
  description = "Floating IP address of the bastion host."
  value       = openstack_networking_floatingip_v2.bastion.address
}

output "dev_instance_ips" {
  description = "Private IPv4 addresses of the development VMs."
  value       = [for p in openstack_networking_port_v2.dev : p.all_fixed_ips[0]]
}

output "shared_volume_id" {
  description = "ID of the shared block storage volume."
  value       = openstack_blockstorage_volume_v3.shared.id
}

output "nfs_server_ip" {
  description = "Private IPv4 address of the dev VM that serves the shared volume over NFS."
  value       = local.nfs_server_ip
}

output "shared_mount_path" {
  description = "Path where the shared volume is mounted on every instance."
  value       = "/srv/shared"
}

#cloud-config
package_update: true
packages:
  - nfs-kernel-server
runcmd:
  - |
    set -eux
    export DEBIAN_FRONTEND=noninteractive
    apt-get install -y ${join(" ", dev_tools)}
    SHARE=/srv/shared
    mkdir -p "$SHARE"
    ROOT_SRC=$(findmnt -no SOURCE /)
    ROOT_DISK=$(lsblk -no PKNAME "$ROOT_SRC" | head -n1)
    DATA_DISK=""
    for i in $(seq 1 60); do
      DATA_DISK=$(lsblk -dno NAME,TYPE | awk '$2=="disk"{print $1}' | grep -v "^$ROOT_DISK$" | head -n1)
      if [ -n "$DATA_DISK" ] && [ -b "/dev/$DATA_DISK" ]; then break; fi
      sleep 5
    done
    DEV="/dev/$DATA_DISK"
    if ! blkid "$DEV"; then mkfs.ext4 -F "$DEV"; fi
    UUID=$(blkid -s UUID -o value "$DEV")
    grep -q "$UUID" /etc/fstab || echo "UUID=$UUID $SHARE ext4 defaults,nofail 0 2" >> /etc/fstab
    mount -a
    chmod 0777 "$SHARE"
    echo "$SHARE ${private_cidr}(rw,sync,no_subtree_check,no_root_squash)" > /etc/exports
    systemctl enable --now nfs-kernel-server
    exportfs -ra

# Dev Environment

Multi-VM development workspace with a shared block volume, private networking, and a bastion host for SSH access patterns common to team development.


**Network class:** throwaway / quickstart-aligned — `external_network` defaults to `PublicEphemeral`; use `PublicStatic` in tfvars when you need a persisted floating IP.

## Prerequisites

- OpenTofu >= 1.6.0 or Terraform >= 1.6.0
- Quake AI account with OpenStack credentials
- Sufficient quota for multiple compute instances, volumes, and networking resources

## Usage

1. Clone or copy this template directory
2. Copy `terraform.tfvars.example` to `terraform.tfvars` and fill in your values
3. Source your OpenStack credentials: `source openrc.sh`
4. Initialize: `tofu init`
5. Preview: `tofu plan`
6. Apply: `tofu apply`

## Variables

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `key_name` | string | yes | n/a | Existing SSH keypair name in the project for compute instances |
| `dev_vm_count` | number | no | `2` | Number of development virtual machines |
| `flavor_name` | string | no | `s1a.medium` | Flavor for each development VM |
| `shared_volume_size` | number | no | `100` | Shared block volume size in GB |
| `image_name` | string | no | `Ubuntu-24.04` | Boot image name |
| `dev_tools` | string | no | `default` | Label applied to instance metadata |
| `external_network` | string | no | `PublicEphemeral` | Defaults to ephemeral quickstart path; set `PublicStatic` for persisted FIP |
| `private_cidr` | string | no | `192.168.30.0/24` | IPv4 CIDR for the private tenant network |
| `bastion_flavor` | string | no | `s1a.small` | Flavor for the bastion instance |

## Documentation

Full documentation: [Dev environment template](/docs/automation/templates/dev-environment)