{"id":19357078,"url":"https://github.com/stealthybox/tf-oci-arm","last_synced_at":"2025-04-23T10:33:10.350Z","repository":{"id":44637392,"uuid":"433641482","full_name":"stealthybox/tf-oci-arm","owner":"stealthybox","description":"Some configurable terraform for a free, firewalled, oracle-cloud ARM Ubuntu machine with @Tailscale and @Docker.","archived":false,"fork":false,"pushed_at":"2023-08-15T16:53:29.000Z","size":16,"stargazers_count":43,"open_issues_count":0,"forks_count":17,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-04-02T14:11:16.815Z","etag":null,"topics":["arm","arm64","cloud-init","docker","oracle-cloud","tailscale","terraform","ufw"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/stealthybox.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-12-01T01:20:48.000Z","updated_at":"2025-02-05T00:06:37.000Z","dependencies_parsed_at":"2022-08-31T09:51:25.126Z","dependency_job_id":null,"html_url":"https://github.com/stealthybox/tf-oci-arm","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stealthybox%2Ftf-oci-arm","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stealthybox%2Ftf-oci-arm/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stealthybox%2Ftf-oci-arm/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stealthybox%2Ftf-oci-arm/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/stealthybox","download_url":"https://codeload.github.com/stealthybox/tf-oci-arm/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":250416965,"owners_count":21427104,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["arm","arm64","cloud-init","docker","oracle-cloud","tailscale","terraform","ufw"],"created_at":"2024-11-10T07:06:14.335Z","updated_at":"2025-04-23T10:33:05.325Z","avatar_url":"https://github.com/stealthybox.png","language":"HCL","funding_links":[],"categories":["docker"],"sub_categories":[],"readme":"# tf-oci-arm\n\nOracle Cloud has a generous Always-Free tier that includes\na 4 CPU, 24 GB RAM, 200 GB disk, arm64 vm.\n\nNetwork limits are very very very generous.\n\nOracle Cloud also has managed terraform (called Stacks).\n\n## this repo\n\nThis terraform + cloud-init project creates an Ampere VM with a public IP\nthat is fully firewalled on a [tailscale](https://tailscale.com) network.\n\nThe OS image is Ubuntu 20.04.\n\nThe cloud-init:\n- Bootstraps Tailscale\n- Configures SSH using your GitHub public keys (fetched from your username)\n- Installs Docker\n\nThe Virtual Cloud Network has a Security List that **blocks all internet traffic** except for\ntailscale's NAT traversal protocols.\n\nUnfortunately, while NAT gateways are Free, they are not available on Free accounts that do\nnot have a payment method, so I left out the private IP config, which is why the VM still\nmust have a public IP.\n\n## pre-reqs\n\n- Oracle Cloud Account\n- Tailscale Account\n- GitHub Account /w SSH Keys configured\n\nYou don't need terraform installed locally, but you could do that.\nWe can use terraform from the Oracle Cloud UI.\n\n## deploy\n\nClone the repo (or fork it):\n```bash\ngit clone git@github.com:stealthybox/tf-oci-arm\ncd tf-oci-arm\n```\n\nCreate a secrets file (it's ignored in git)\n```bash\ncp secret.auto.tfvars.example secret.auto.tfvars\n```\n\nUpdate the secret values:\n1. Update your `github_user` in the `secret.auto.tfvars` file\n2. Create a Compartment for `tf-oci-arm`: https://cloud.oracle.com/identity/compartments  \n   Copy the OCID of your new compartment  \n   Update the config  \n3. Create a Tailscale Auth Key: https://login.tailscale.com/admin/settings/authkeys  \n   Copy the key  \n   Update the config  \n\nNow, create a Stack in Oracle Cloud: https://cloud.oracle.com/resourcemanager/stacks  \nUpload your folder or zip it up first.  \n(I have to use a zip personally, because WSL2 browser uploads are limited)\n\nCopy your Compartment OCID into the field again.\n\nAck your values in the form.\n\nApply the Stack!\n\nHopefully it succeeds for you!  \nIt should if you made no changes to the cloud-init and your values are correct.\n\nYou should be able to `ssh oracle-arm` now from any machine with your private keys on your tailnet.\n\u003e if your local username doesn't match your github user, you'll need to `ssh ${GITHUB_USER}@oracle-arm`\n\n## sudo\n\nOnce you're SSH'd in congrats. You can access any port of oracle-arm over your tailnet IP.\n\nYou won't have sudo access though because your user doesn't have a password yet.  \nYou can load your passwordhash through cloud-init or setup, NOPASSWD sudo.  \nFor now, I've settled on abusing the docker group to get a root shell to call `passwd` to manually set my\nsudo password when I install my tools and shell config:\n```bash\ndocker run -it --rm --pid host --privileged justincormack/nsenter1\n\npasswd $(id -nu 1000)\nexit\n\nwhoami\nsudo whoami\n```\n\n## remote docker\n\nWant to `docker run` arm64 containers remotely from your laptop?\nTry out running NGINX or something:\n```bash\nGITHUB_USER=octocat\n\ndocker context create oracle-arm --docker \"host=ssh://${GITHUB_USER}@oracle-arm\"\n\nDOCKER_CONTEXT=oracle-arm docker run --name nginx -d --rm -p 80:80 nginx\n\ncurl oracle-arm\n\nDOCKER_CONTEXT=oracle-arm docker stop nginx\n```\nThat's a private connection :)\n\n## debugging\n\nVery quickly after the terraform Stack succeeds, you should be able to SSH into your VM over tailscale.\nIf not, that's sad, and there's something wrong with your firewall config, or more likely, your tailscale key.\nMaybe try minting a new tailscale key.\n\nAlternatively, modify the Virtual Cloud Network's \"Security List\" to allow SSH on tcp/22 via the public IP, so you\ncan login over the internet and debug what's going wrong.\n\n## gotchas\n\nIf your Oracle Cloud Account is brand-new, you'll get free trial credits and\nunlimited access to all API's for 30 days.\nAfter that 30 days, if you don't add a billing method, your VM will be deleted\nautomatically, and you will lose your files.\n\nYou can re-create your VM with your new downgraded Free Account, and it will then\npersist forever.\n\nIf you want to side-step this 30-day ticking time-bomb, you could probably just\nadd a credit card. Maybe you could even then remove it, but I can't test that theory.\nI'm not sure if there's another way to invalidate the 30-day free credits other than\nwaiting.\n\nAn older version of this repo used `ufw` for the instance firewall instead of the\nOCI VCN's Security List, but this turned out to be brittle for two reasons:\n- 1. It was hard to get the firewalls to stop fighting each other, which made `ufw` unreliable\n- 2. Docker's NAT rules and `ufw` don't easily fit together if `ufw` is set to default deny.\n\nI just chose to stop using `ufw` and start managing the firewall /w terraform, but if you\nreally want to use `ufw`, you can try to confidently solve problem #1 and use\n[chaifeng/ufw-docker](https://github.com/chaifeng/ufw-docker) to solve problem #2.\n\nI left the default shell as zsh, sorry.\nFork and modify if you like :)\n\n## resources\nTailscale has some docs on using the Oracle Cloud firewall + setting up Split DNS\nhttps://tailscale.com/kb/1149/cloud-oracle/\n\nThis person's entire web log is lovely and they explain Oracle's iptables if you really want to try using `ufw`:\nhttps://www.cflee.com/posts/oci-first-look-2/\n\nThis article details some of the oracle cloud service limits:\nhttps://virtualizationreview.com/articles/2021/09/14/using-oracle-cloud.aspx\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstealthybox%2Ftf-oci-arm","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fstealthybox%2Ftf-oci-arm","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstealthybox%2Ftf-oci-arm/lists"}