Machines

stackpanel.infra.machines = {
  enable = true;
  source = "static";

  machines = {
    web-1 = {
      name = "Web Server 1";
      host = "web1.example.com";
      roles = [ "web" "app" ];
      tags = [ "production" "us-east" ];
      provider = "hetzner";
      arch = "x86_64-linux";
      publicIp = "203.0.113.10";
      privateIp = "10.0.1.10";
      targetEnv = "production";

      ssh = {
        user = "deploy";
        port = 22;
        keyPath = "~/.ssh/deploy_ed25519";
      };

      labels = {
        team = "platform";
        cost-center = "infra";
      };
    };

    db-1 = {
      name = "Database Primary";
      host = "10.0.2.10";
      roles = [ "database" ];
      tags = [ "production" ];
      arch = "x86_64-linux";
      targetEnv = "production";
      ssh.user = "root";
    };
  };
};

stackpanel.infra.machines = {
  enable = true;
  source = "aws-ec2";

  aws = {
    region = "us-west-2";

    # EC2 filters (same syntax as AWS CLI --filters)
    filters = [
      { name = "instance-state-name"; values = [ "running" ]; }
      { name = "tag:Project"; values = [ "myapp" ]; }
    ];
  };
};

stackpanel.infra.machines.aws = {
  region = "us-west-2";

  # Which EC2 tags map to machine roles
  role-tag-keys = [ "stackpanel:role" "Role" ];

  # Which EC2 tags map to machine tags
  tag-keys = [ "stackpanel:tag" "Environment" ];

  # Which EC2 tags map to target environment
  env-tag-keys = [ "stackpanel:env" "Stage" ];

  # Which EC2 tags provide the machine name
  name-tag-keys = [ "Name" ];

  filters = [
    { name = "instance-state-name"; values = [ "running" ]; }
  ];
};

stackpanel.infra.machines.aws = {
  # Try public DNS first, then public IP, then private IP
  host-preference = [ "publicDns" "publicIp" "privateIp" ];
};

stackpanel.infra.machines.aws = {
  host-preference = [ "privateIp" ];
};

stackpanel.infra.machines.aws = {
  ssh = {
    user = "ec2-user";
    port = 22;
    keyPath = "~/.ssh/aws_deploy";
  };
};

stackpanel.infra.machines.aws = {
  instance-ids = [
    "i-0abc123def456789a"
    "i-0def456789abc1230"
  ];
};

stackpanel.infra.aws-ec2-app = {
  enable = true;

  apps = {
    web-server = {
      instance-count = 2;
      instance-type = "t3.small";
      os-type = "ubuntu";              # or "nixos"
      associate-public-ip = true;

      # Auto-creates a security group with SSH + HTTP + HTTPS
      security-group.create = true;

      # Auto-creates IAM role with SSM + ECR access
      iam.enable = true;

      # Import your SSH public key
      key-pair = {
        create = true;
        public-key = "ssh-ed25519 AAAA...";
      };

      # Machine metadata for Colmena targeting
      machine = {
        roles = [ "web" ];
        tags = [ "production" ];
        target-env = "production";
      };
    };
  };
};

infra:deploy
infra:pull-outputs
exit && nix develop --impure

stackpanel.apps.api = {
  port = 1;
  root = "./apps/api";

  # Deploy this app to machines with the "web" role
  deploy = {
    enable = true;
    role = "web";
  };
};

stackpanel.apps.worker = {
  port = 2;
  root = "./apps/worker";

  # Deploy to specific machines by name
  deploy = {
    enable = true;
    targets = [ "worker-1" "worker-2" ];
  };
};

{
  # Infrastructure provisioning
  stackpanel.infra = {
    enable = true;
    storage-backend = {
      type = "sops";
      sops.group = "dev";
    };

    # AWS secrets (IAM role, KMS key)
    aws.secrets = {
      enable = true;
      oidc.provider = "github-actions";
      oidc.github-actions = {
        org = "my-org";
        repo = "my-repo";
      };
    };

    # Machine discovery
    machines = {
      enable = true;
      source = "aws-ec2";
      aws = {
        region = "us-west-2";
        filters = [
          { name = "instance-state-name"; values = [ "running" ]; }
          { name = "tag:Project"; values = [ "myapp" ]; }
        ];
        ssh.user = "deploy";
      };
    };
  };

  # Apps with deployment targets
  stackpanel.apps = {
    web = {
      port = 0;
      root = "./apps/web";
      deploy = {
        enable = true;
        role = "web";
      };
    };

    api = {
      port = 1;
      root = "./apps/api";
      deploy = {
        enable = true;
        role = "api";
      };
    };
  };
}

# Provision infrastructure and discover machines
infra:deploy

# Pull machine inventory into local state
infra:pull-outputs

# Reload shell to pick up new inventory
exit && nix develop --impure

# View machines in Studio
# Navigate to /studio/deploy

# Deploy with Colmena
colmena apply

stackpanel.deployment.flakeOutputs = {
  expose = false;
  flakeDir = "./deploy";
};

aws ec2 describe-instances \
  --region us-west-2 \
  --filters "Name=instance-state-name,Values=running" "Name=tag:Project,Values=myapp" \
  --query 'Reservations[].Instances[].{Id:InstanceId,Name:Tags[?Key==`Name`].Value|[0]}'

ssh -o ConnectTimeout=5 deploy@<machine-host> 'echo ok'