# Infomaniak — activate Public Cloud + get your OpenStack credential

> **Goal:** turn on a **Public Cloud** project and produce the **`clouds.yaml`**
> credential that `mgf-cloud` / `mgf-fed` use to manage VMs and storage.
> **Prerequisite:** a ready account with 2FA + billing — see
> [guide 01](01-infomaniak-account-and-organization.md).

Infomaniak Public Cloud is **standard OpenStack**, so the credential is an OpenStack
**Application Credential**, not your account password.

## Step 1 — Order the Public Cloud project (the billing step)

1. Manager → **Cloud Computing → Public Cloud**.
2. If you have no project yet you'll see *"You have no Public Cloud."* Click
   **"Order a Public Cloud"** ("Discover our offers" shows pricing first).
3. **Cost model:** pay-as-you-go — the project is free; you pay hourly only for what
   you provision (vCPU/RAM/disk, floating IPs, object storage). The federation's
   first need (a self-hosted Woodpecker CI host) is a small VM
   (`a2-ram2-disk20`) + a floating IP ≈ a few CHF/month.
4. During the order, set:
   - **Project name** — e.g. `mgf`.
   - **Region** — **Geneva `dc3-a`** (the Magogi default; DR target `dc4-a`).
   - Confirm the payment method.

## Step 2 — Pass identity verification (KYC)

After ordering you may see **"Action required — check your identity"** /
*"Security procedure required"* on the new project, with a **"Follow the
procedure"** button. Infomaniak runs a KYC check before activating Public Cloud:
follow it (typically an ID-document upload), then wait for their review. When it
clears, the order shows **COMPLETED** and the project activates.

## Step 3 — Open the OpenStack (Horizon) dashboard

Manager → **Cloud Computing → Public Cloud → your project** → open the
**OpenStack / Horizon** dashboard (a lightly-rebranded standard Horizon, typically
at `https://dashboard.pub1.infomaniak.cloud`). Log in with project scope.

## Step 4 — Create the Application Credential

In Horizon's left sidebar: **Identity → Application Credentials → "+ Create
Application Credential"**:

- **Name:** `mgf-cloud`
- **Secret:** leave blank (auto-generated).
- **Expiration:** blank for none (you can rotate later).
- **Roles:** keep the defaults — must include **`member`** (so it can create/delete
  VMs + volumes).
- **Unrestricted:** leave **unchecked**.

Click **Create**. The popup shows the **ID** and **Secret** — ⚠️ the **secret is
shown only once**.

## Step 5 — Download `clouds.yaml`

On that same success popup click **"Download clouds.yaml"** (it bakes the
application-credential id + secret in). It looks like:

```yaml
clouds:
  openstack:
    auth:
      auth_url: https://api.pub1.infomaniak.cloud/identity/v3
      application_credential_id: "…"
      application_credential_secret: "…"
    region_name: "dc3-a"
    interface: "public"
    identity_api_version: 3
    auth_type: "v3applicationcredential"
```

> **No "Download clouds.yaml" button?** Copy the **ID + Secret** from the popup and
> paste them into a file using the template above — that's all `mgf-cloud` needs.

## Step 6 — Store it (never commit it)

Save the file to:

```
mgf-standard/my_stuff/tokens/infomaniak_clouds.yaml
```

`my_stuff/` is git-ignored fleet-wide (rule **AG-18**), so the secret stays out of
git. `mgf-cloud` resolves credentials from `clouds.yaml` / `OS_*` env /
`$MGF_CLOUD_CLOUDS_YAML`.

## Step 7 (optional) — S3 object storage

The Application Credential already covers VM + block + **Swift** object storage.
For the **S3** endpoint (`https://s3.pub1.infomaniak.cloud/`) generate EC2 keys —
`openstack ec2 credentials create` — or let `mgf-cloud` generate them for you once
the credential above works.

## Magogi Public Cloud defaults

| Decision | Default |
|---|---|
| Region | `dc3-a` (Geneva); DR `dc4-a` |
| OS image | Ubuntu 24.04 LTS |
| Flavour (small service) | `a2-ram2-disk20` (1 vCPU / 2 GB / 20 GB); scale `a2-ram4-disk40` |
| Network | `ext-net1` (public) |
| Floating IPv4 | always attach for production |
| Volume | persistent, *Delete on Terminate = No* |
| SSH user | `ubuntu` (key-only) |
| Security group | open service ports + 22; block egress :25 (no direct mail) |
| Object storage | Swift (native); S3 at `s3.pub1.infomaniak.cloud` |
| Approval | two-person for prod create/delete/floating-IP/resize |

## Rotation / revocation

To revoke: delete the Application Credential in Horizon and create a new one;
nothing else in the fleet hard-codes it — just replace `infomaniak_clouds.yaml`.

## Next

The credential is now in place. `mgf-cloud` reads it to manage resources, and
`mgf-fed` uses `mgf-cloud` to provision the federation's Infomaniak hosts (starting
with the self-hosted Woodpecker CI host). See
[`mgf-cloud`](https://codeberg.org/magogi-admin/mgf-cloud).
