Skip to main content

Provider Setup

Getting an Infomaniak account, commissioning Public Cloud, and wiring up its credentials — before OpenTofu can provision anything against them at all. Assumes Security → Proton Pass Setup is already done — the vault, the <prefix>- convention, and the pass:// pattern below all come from there.

Infomaniak​

1. Create an account​

Sign up at infomaniak.com — standard account creation, nothing Public Cloud-specific yet. Enable 2FA on it right away, and fill <prefix>-infomaniak-user-admin in with the login.

2. Add a payment method​

Public Cloud is billed per resource, per hour, not a fixed plan (see Framework → Public Cloud → Cost) — a payment method has to be on file in the Manager before the product can actually be commissioned in the next step.

3. Commission Public Cloud​

In the Infomaniak Manager, order a new Public Cloud project from the Public Cloud section — not something that exists on the account by default. A right-arrow icon next to it then gives direct access to its Horizon dashboard, needed for the credentials below.

4. Generate the DNS API token​

Fill <prefix>-infomaniak-developer-api-token's token field in — Infomaniak Manager → Account settings → API Tokens, not generated via CLI. Only needed if OpenTofu manages DNS via the Infomaniak provider, not via OpenStack's own DNS module.

OpenStack​

1. Install the OpenStack CLI​

brew install openstackclient

2. Wire up credentials via Proton Pass​

Proton Pass Setup already created every item below as an empty shell — this is where each one actually gets filled in, in order, since each step depends on what came before it:

  1. <prefix>-openstack-user — fill in username/password with the Horizon account from Security → Security architecture → Infrastructure credentials, fetched from the Horizon web console above, not a CLI. The human login everything below actually gets created through, and it's reused further down for a temporary v3password login.
  2. <prefix>-openstack-app-credential and <prefix>-openstack-s3-access-key — this is the first application credential being created, so nothing app-credential-scoped exists yet to create it with. Both this and the EC2 keys below need the same temporary v3password login instead, pulled from <prefix>-openstack-user — worth sharing one throwaway file across both rather than creating and deleting it twice:
    1. Create a throwaway env file from its own template — not the main .env, since these fields conflict with the app-credential auth type already there: 
      sed -e 's/<vault>/<your-vault-name>/g' -e 's/<prefix>/<your-prefix>/g' .env.v3password.example > .env.v3password
    2. Create the application credential through it: 
      pass-cli run --env-file .env.v3password -- openstack application credential create <name>
      Fill id and secret into <prefix>-openstack-app-credential (used for compute/network/storage/DNS-zone auth) — secret is only ever shown this once, not retrievable later.
    3. While the same login is still wired up, create the S3 access key too. These are Keystone "EC2 credentials," a distinct type from an application credential — required because the S3 gateway signs requests SigV4-style, and notably something an application credential specifically can't create on its own (openstack ec2 credentials create 403s under one, by design) — existing ones are still readable via openstack ec2 credentials list: 
      pass-cli run --env-file .env.v3password -- openstack ec2 credentials create
      Fill access and secret into <prefix>-openstack-s3-access-key (used for OpenTofu's state backend).
    4. Leave the throwaway file in place — Set up TOTP below reuses it before it gets deleted for good.
  3. Create the actual .env (gitignored) from the template — it already points at everything above, just with the vault name and prefix left as placeholders. Fill them in during the same copy, rather than editing the file by hand afterward: 
    sed -e 's/<vault>/<your-vault-name>/g' -e 's/<prefix>/<your-prefix>/g' tofu/personal-cloud/.env.example > tofu/personal-cloud/.env

3. Set up TOTP for OpenStack​

Closes the gap flagged in Security → Security architecture → Infrastructure credentials: Horizon has no second factor of its own by default. This is Keystone's own MFA, set up via CLI — Horizon has supported TOTP login since OpenStack Bobcat (a feature Infomaniak's own customers specifically requested), but confirm it with an actual Horizon login afterward rather than assuming it carries over. Procedure per Infomaniak's own TOTP documentation.

  1. Reuse the throwaway v3password env file from step 2 above (recreate it if it was already deleted).
  2. Generate the secret and fetch the IDs — run once, re-running orphans the old secret: 
    pass-cli run --env-file .env.v3password -- openstack token issue --format json > /tmp/token.json
    OS_USERID=$(jq -r '.user_id' /tmp/token.json)
    rm /tmp/token.json
    OS_PROJECT_ID=$(pass-cli run --env-file .env -- openstack project list -f value -c ID)
    TOTPKEY=$(python3 -c "import base64, os; print(base64.b32encode(os.urandom(20)).decode().rstrip('='))")
    echo "OS_PROJECT_ID=$OS_PROJECT_ID" >> .env.v3password
  3. Create the TOTP credential: 
    pass-cli run --env-file .env.v3password -- openstack credential create --type totp --project "$OS_PROJECT_ID" "$OS_USERID" "$TOTPKEY"
  4. Add $TOTPKEY to <prefix>-openstack-user's TOTP field via the Proton Pass app itself, not pass-cli (it can't write TOTP fields): 
    echo "$TOTPKEY"
    Confirm it's showing a live-generating code before moving on.
  5. Enforce both factors for the human login — but exempt application credentials from TOTP specifically, in the same command (each --multi-factor-auth-rule call replaces the whole rule set rather than adding to it, so both have to be set together or the first one gets silently dropped): 
    pass-cli run --env-file .env.v3password -- openstack user set --multi-factor-auth-rule password,totp --multi-factor-auth-rule application_credential "$OS_USERID"
    sed -i '' 's/OS_AUTH_TYPE=v3password/OS_AUTH_TYPE=v3multifactor/' .env.v3password
    echo "OS_AUTH_METHODS=v3password,v3totp" >> .env.v3password
    echo "OS_PASSCODE=pass://<vault>/<prefix>-openstack-user/totp" >> .env.v3password
    echo "OS_USER_DOMAIN_NAME=default" >> .env.v3password
    pass-cli run --env-file .env.v3password -- openstack user set --enable-multi-factor-auth "$OS_USERID"
    TOTP protects the human Horizon login; <prefix>-openstack-app-credential (OpenTofu's own, used non-interactively) deliberately stays exempt — a live TOTP code can't work there anyway, since OpenTofu authenticates more than once per run and a code is single-use, so the credential's protection is scoping instead, not a second factor.
  6. Confirm with a real Horizon login, using a fresh code from Proton Pass.
  7. Clean up: 
    rm .env.v3password

To reverse this later, the same pattern in reverse: openstack user set --disable-multi-factor-auth "$OS_USERID".