feat: backup and restore

infra/main.tf

@@ -1,6 +1,8 @@
 # Root module: wires together the shared network and the three host modules
 # (one per server in docs/architecture.md). Each host module owns its own
-# firewall (and volume, where applicable) - see modules/<host>/main.tf.
+# firewall - see modules/<host>/main.tf. Persistent data lives in named Docker
+# volumes backed up to S3 (see services/<host>/backup-docker-compose.yml), not
+# on Hetzner volumes.
 
 locals {
   # SSH to dev/prod is only permitted from the vpn server's public IP: admins must
@@ -28,8 +30,6 @@ locals {
     { zone = "luke-else.co.uk", name = "traefik.cicd", value = module.dev.ipv4 },
     { zone = "luke-else.co.uk", name = "vpn", value = module.vpn.ipv4 },
     { zone = "luke-else.co.uk", name = "traefik.vpn", value = module.vpn.ipv4 },
-    { zone = "divine-couture.co.uk", name = "www", value = module.prod.ipv4 },
-    { zone = "snexo.co.uk", name = "@", value = module.prod.ipv4 },
   ]
 }
 
@@ -50,7 +50,6 @@ module "dev" {
   ssh_key_ids            = local.ssh_key_ids
   network_id             = module.network.id
   private_ip             = var.dev_private_ip
-  volume_size            = var.dev_volume_size
   allowed_ssh_source_ips = local.vpn_ssh_source_ips
   network_ip_range       = var.network_ip_range
 
@@ -68,7 +67,6 @@ module "prod" {
   ssh_key_ids            = local.ssh_key_ids
   network_id             = module.network.id
   private_ip             = var.prod_private_ip
-  volume_size            = var.prod_volume_size
   allowed_ssh_source_ips = local.vpn_ssh_source_ips
   network_ip_range       = var.network_ip_range