Incus-Automation

Incus and OpenTofu Setup

I plan on installing Incus and using ansible playbooks to easily create and destroy Incus containers.
This document will contain how I set up Incus and how to use OpenTofu to automate the deployment of Incus containers.

Run the command “sudo apt update && sudo apt install wget curl git openssh-server openvswitch-switch –y"
Run the command “sudo apt install incus”

Go to root user by running “sudo su -”
CD into netplan by running “cd /etc/netplan”
When you run “ls” you should get a file similar to the name of “50-cloud-init.yaml”
Make a backup of this file by running “cp 50-cloud-init.yaml 50-cloud-init.yaml.bak”
Make note of your network interfaces by running “ip –br –c a”
Nano into the 50-cloud-init.yaml file and add the following configuration:

Important:

Things you need to change include:
Adapter name (Example: enp2s0)
IP and Subnet (Example: 10.0.0.191/24)
Default gateway (Example: 10.0.0.1)
Name Servers (Examples: 10.0.0.1, 75.75.75.75, 75.75.76.76)
Save the file by doing CTRL + O, enter, and CTRL + X.
Test the configuration by running “netplan try” and you should get something like this:
If you got an error, check the configuration that we just made.
If you got no error, use “netplan apply” to apply the configuration.

Leave root user by running “exit”
Run the command “sudo usermod –aG incus-admin connor” (connor being the username of your account)
Log out and log back in for the changes to take effect.

Run “incus admin init”
You will get asked a series of questions. You can answer these based on your requirements. Here is what I used:

Run “incus list” to view any active containers running. It is blank since we haven’t made one yet.
Run “incus image list images:”
- The output is a crazy long list of different images you can use.

This bridge will allow our containers to get an IP address assigned to them.
Run the command “incus profile create bridgeprofile”
Next add a device connection to be used by your containers by running “incus profile device add bridgeprofile eth0 nic nictype=bridged parent=bridge0”

Run the command “incus launch images:ubuntu/24.04 my-first-container --profile default --profile bridgeprofile”
Run the command “incus config device add my-first-container eth0 nic nictype=bridged parent=incusbr0 name=eth0”
Check your new container by running “incus list”

Run the following two commands:
- mkdir -p ~/.opentofu.d/plugins/github.com/lxc/incus/0.2.0/linux_amd64
- curl -L https://github.com/lxc/terraform-provider-incus/releases/download/v0.2.0/terraform-provider-incus_0.2.0_linux_amd64.tar.gz | tar -xz -C ~/.opentofu.d/plugins/github.com/lxc/incus/0.2.0/linux_amd64

Make the directory using the command:
- mkdir incus-tofu && cd incus-tofu
Make a cloud-init.yaml file. Here is my configuration I used to create a user with passwordless sudo, importing my ssh keys, and connecting to my tailscale network.
Make a main.tf file. This is the OpenTofu part of the deployment. It holds all the variables for when you run the initialization.

To get your Tailscale authentication key, navigate to your tailscale administrative panel.
- Click on settings
- Under “Personal Settings” click “Keys”
- Click “Generate auth key...”
- This provides you with a key to copy. Important: This key will not be able to be copied after you close the pop up. Make sure to store it somewhere safe.
Now that you have the auth key, go back to your Linux Machine in your incus-tofu directory and make a new file.
- nano secrets.auto.tfvars
- Type “tailscale_auth_key = “Paste your key here”

Type “tofu init”
- If you get errors, there is something wrong with your configuration and you will want to troubleshoot that.
After it is initialized, run the command:
- tofu apply
  - It will ask you if you want to perform the actions. Simply type “yes”

Run the command:
- Incus list
As you can see, it has two IPv4 addresses, one being the LAN and the other being the tailscale network. This shows that tailscale has connected.
Ssh into the container with “ssh connor@10.163.116.52”
We have successfully deployed an incus container with cloud-init and opentofu!