exposing terraform info back to nixos configurations

[KiaraGrouwstra]

in order to prevent duplication and hard-coding, it would be nice if we had a way to pass info from TF to the nixos configurations.

before nixos-anywhere i used teraflops, which exposed a static TF show -json dump thru a specialArgs parameter resources.
now, they can use such a static dump as they deploy the nix bits after terraform. as nixos-anywhere deploys nixos during terraform execution, here such info would instead need to be passed from within the terraform.

this could be facilitated in different ways, e.g. opinionated like teraflops (exposing such info in a given format), versus more generically by just passing thru more nix arguments, while leaving the details to the user.

there would also be considerations there between exposing info in a pure vs impure way:

• passing info in a pure way, as files
  • pros:
    • may be preferred by nix
  • cons:
    • irrelevant changes in ephemeral TF info may show up in git (if not also triggering unnecessary rebuilds)
• passing info in an impure way, as env vars
  • pros:
    • no fighting flakes about needing to stage files to git
  • cons:
    • if this is impure, i'm not sure if nix would still know whether it should rebuild if just the contents change

[lina-bh]

i had this same problem and after fighting forever with flakes, i touched upon this solution for now:

resource "local_file" "arm-nixincludes" {
  filename        = "${path.module}/arm/tofuout.nix"
  file_permission = "0644"
  content         = <<EOT
{ networking.hostName = "${oci_core_instance.arm.display_name}"; }
EOT
}

module "nixos-anywhere" {
  source = "github.com/nix-community/nixos-anywhere/terraform/all-in-one"
  depends_on = [
    local_file.arm-nixincludes
  ]
  ...

another solution i thought about sitting on the toilet: allow the nixos-rebuild module to create a configuration from a function defined in the flake, to which you can pass --args from the terraform side. but like you say this might have dependency tracking pitfalls. EDIT: i personally decided to split up the responsibilities between cloud infra and system deployment, but while i did i hacked up a script in a couple hours which injects values into the nixos configuration through a function, gets the store path of that derivation, builds its output and pushes it to a target much like the terraform/nixos-rebuild module. https://gist.github.com/lina-bh/b652678579d55949d1bfbd71d34d2720

put this down to the long list of problems caused by flakes' behaviour with git, and not having an impure escape hatch