luke-else/server
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

feat: Added terraform config... just a basic one at first

Browse Source
This commit is contained in:
luke-else
2026-07-09 21:55:50 +01:00
parent 5486716981
commit 3bfa0e6f32
33 changed files with 1235 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infra/.terraform.lock.hcl
Generated
+35
View File
@@ -0,0 +1,35 @@
# This file is maintained automatically by "tofu init".
# Manual edits may be lost in future updates.
provider "registry.opentofu.org/hetznercloud/hcloud" {
version = "1.66.0"
constraints = "~> 1.45"
hashes = [
"h1:+R3t/5wqCb2ics5bNZ4JgtfaAa08Z6uRzXzNtwovVEY=",
"h1:9c1ECk3N9xhdQKz4NVCfYEFxebJVVeQZS3E6wrR/Hx8=",
"h1:EtYB/KjPN2cIJa6hpEaVc8q/3yf6e9IT6/uAybUGqps=",
"h1:GUupu6Fg5zFY9i4/3esiy8uHZnUrt+u2B6NaE4+8YqQ=",
"h1:JHehRJySEFRGYK+D6pFS0MTTDDRlGSQdSaKdEo0AemA=",
"h1:XF+SwyO1ttQJ0WXJ5O628O7cGk9U37sGn0o3LwWUnDQ=",
"h1:czuvCXAd8CcszXh3k3E0N6tFfQkYSNbKXo99LG+yOIc=",
"h1:dPIwO6zTxYs6bHn5yf/w/1AExaHPppCLyTrWrdzH4RE=",
"h1:gqrhnYuIBzpUvgWHITNRUMLaDcKACGlrNfrbtbtO7KY=",
"h1:iVAGP8gRbZK0kJF7SiYJRt61wz0D5AF9q+WMsrAiBI0=",
"h1:kLi29SbGCU/Z/Ch0zuNdYFSKP3mHp8zfcOpZsIN/KIQ=",
"h1:mq2+1Q/5gWJYI8XOXQCeteUg0AP7VezPOGOjkkHRQso=",
"h1:rnWTWAOlJhHtD3kkU4Qfw0bg9ko/dlH822inxYLBmfQ=",
"zh:1286cee6fb63dbcb18f53077bbb5e5d132a4e4d9f006af4e8d8edfc08d6bcdc8",
"zh:204460dacc044bda019a4a18b398e094289500c36913c7c9457f432adf31b8b2",
"zh:214175d50773481cbeaf9c9004e4121a3a1c9686c79424ebdc8ff189dd057d3e",
"zh:22b17bceff61cc13ad04a399ba87521356a3a134d4687273727473ae9eccf5f1",
"zh:368867dac5525c411de7e38f2e27de0a71854d1750867322ff2b9321128c88fb",
"zh:5289b75f8370bdbc4c6051d55cf33d0b1bd25dc6d71bfbd39b360249a37f1501",
"zh:81cb676aa50c5777df8fc80d4e69c9012330ae751f5e6f12bf6074bfd2e7c496",
"zh:ab08aead10643b21aa6b51af562b50492e12b9dd0ab7dca27a05aa63209b7d66",
"zh:af25c210d0570cf61ef767b2545bf9f3fb909178135f0e5e14bec0c1c9d07a63",
"zh:bcad66f4830c97118fa793723e53f8a4d27ddd34ea969ff259408842c2238331",
"zh:ce3ed323d75ae905d975925fa98c7054a7514c81276a485fc37da8232b53e39f",
"zh:d481bc0ef0c87ab1969c17777f526b2f59f823432d676145134c41a6d29bd98e",
"zh:ea7ef88df2c3ca154d86238920636d52a3c9066c7467543d3fa45f1e52ec2f7b",
]
}
infra/firewalls.tf
+162
View File
@@ -0,0 +1,162 @@
# Port sources: services/*/docker-compose.yml (published ports) and services/todo.md
# (the documented UFW allow-list). dev has no firewall in architecture.md, but we add
# one anyway for baseline safety - see conversation history.
resource "hcloud_firewall" "dev" {
name = "dev-firewall"
rule { # server ssh
direction = "in"
protocol = "tcp"
port = "22"
source_ips = var.allowed_ssh_source_ips
}
rule { # gitea ssh (git.luke-else.co.uk, published as 222:22)
direction = "in"
protocol = "tcp"
port = "222"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule { # TraefikRunner http/https (git.luke-else.co.uk, cicd.luke-else.co.uk)
direction = "in"
protocol = "tcp"
port = "80"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule {
direction = "in"
protocol = "tcp"
port = "443"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule { # traffic from prod over the private network
direction = "in"
protocol = "tcp"
port = "1-65535"
source_ips = [var.network_ip_range]
}
rule {
direction = "in"
protocol = "udp"
port = "1-65535"
source_ips = [var.network_ip_range]
}
}
resource "hcloud_firewall" "prod" {
name = "prod-firewall"
rule { # server ssh
direction = "in"
protocol = "tcp"
port = "22"
source_ips = var.allowed_ssh_source_ips
}
rule { # Traefik http/https (Websites, Bitwarden, Misc, Tracking)
direction = "in"
protocol = "tcp"
port = "80"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule {
direction = "in"
protocol = "tcp"
port = "443"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule { # mongo via Traefik tcp entrypoint (Database)
direction = "in"
protocol = "tcp"
port = "27017"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule { # rustdesk hbbs
direction = "in"
protocol = "tcp"
port = "21115"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule {
direction = "in"
protocol = "tcp"
port = "21116"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule {
direction = "in"
protocol = "udp"
port = "21116"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule { # rustdesk hbbr
direction = "in"
protocol = "tcp"
port = "21117"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule {
direction = "in"
protocol = "tcp"
port = "21119"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule { # traffic from dev over the private network
direction = "in"
protocol = "tcp"
port = "1-65535"
source_ips = [var.network_ip_range]
}
rule {
direction = "in"
protocol = "udp"
port = "1-65535"
source_ips = [var.network_ip_range]
}
}
resource "hcloud_firewall" "vpn" {
name = "vpn-firewall"
rule { # server ssh
direction = "in"
protocol = "tcp"
port = "22"
source_ips = var.allowed_ssh_source_ips
}
rule { # TraefikVPN http/https (traefik.vpn.luke-else.co.uk)
direction = "in"
protocol = "tcp"
port = "80"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule {
direction = "in"
protocol = "tcp"
port = "443"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule { # OpenVPN tunnel - always direct to this server's public IP, never via a load balancer
direction = "in"
protocol = "udp"
port = "1194"
source_ips = ["0.0.0.0/0", "::/0"]
}
}
infra/network.tf
+13
View File
@@ -0,0 +1,13 @@
# Private network shared by dev and prod (see architecture.md "network" group).
# vpn is intentionally not attached to this network - it sits outside it in the diagram.
resource "hcloud_network" "main" {
name = "server-network"
ip_range = var.network_ip_range
}
resource "hcloud_network_subnet" "main" {
network_id = hcloud_network.main.id
type = "cloud"
network_zone = var.network_zone
ip_range = var.subnet_ip_range
}
infra/outputs.tf
+19
View File
@@ -0,0 +1,19 @@
output "dev_ipv4" {
value = hcloud_server.dev.ipv4_address
}
output "dev_private_ipv4" {
value = var.dev_private_ip
}
output "prod_ipv4" {
value = hcloud_server.prod.ipv4_address
}
output "prod_private_ipv4" {
value = var.prod_private_ip
}
output "vpn_ipv4" {
value = hcloud_server.vpn.ipv4_address
}
infra/servers.tf
+43
View File
@@ -0,0 +1,43 @@
# dev: Gitea + Runner + TraefikRunner (git.luke-else.co.uk, cicd.luke-else.co.uk)
resource "hcloud_server" "dev" {
name = "dev"
server_type = var.dev_server_type
image = var.server_image
location = var.location
ssh_keys = [data.hcloud_ssh_key.main.id]
firewall_ids = [hcloud_firewall.dev.id]
network {
network_id = hcloud_network.main.id
ip = var.dev_private_ip
}
depends_on = [hcloud_network_subnet.main]
}
# prod: Traefik, Websites, Database, Bitwarden, Misc, Tracking, Rustdesk
resource "hcloud_server" "prod" {
name = "prod"
server_type = var.prod_server_type
image = var.server_image
location = var.location
ssh_keys = [data.hcloud_ssh_key.main.id]
firewall_ids = [hcloud_firewall.prod.id]
network {
network_id = hcloud_network.main.id
ip = var.prod_private_ip
}
depends_on = [hcloud_network_subnet.main]
}
# vpn: OpenVPN + TraefikVPN. Not attached to the private network (see architecture.md).
resource "hcloud_server" "vpn" {
name = "vpn"
server_type = var.vpn_server_type
image = var.server_image
location = var.location
ssh_keys = [data.hcloud_ssh_key.main.id]
firewall_ids = [hcloud_firewall.vpn.id]
}
infra/ssh.tf
+3
View File
@@ -0,0 +1,3 @@
data "hcloud_ssh_key" "main" {
name = var.ssh_key_name
}
infra/terraform.tfvars.example
+18
View File
@@ -0,0 +1,18 @@
# Copy to terraform.tfvars and fill in - terraform.tfvars itself is gitignored,
# never commit real values there.
#
# The Hetzner API token is NOT set here: export it as HCLOUD_TOKEN in your shell
# before running tofu plan/apply.
# Name of an SSH key already uploaded to your Hetzner Cloud project
# (Console > Security > SSH Keys). Required.
ssh_key_name = "your-key-name"
# Optional overrides - defaults live in variables.tf
# location = "nbg1"
# dev_server_type = "cx22"
# prod_server_type = "cx32"
# vpn_server_type = "cx22"
# dev_volume_size = 50
# prod_volume_size = 50
# allowed_ssh_source_ips = ["203.0.113.4/32"]
infra/variables.tf
+82
View File
@@ -0,0 +1,82 @@
variable "location" {
description = "Hetzner Cloud datacenter location for all servers and volumes."
type = string
default = "nbg1"
}
variable "network_zone" {
description = "Hetzner Cloud network zone matching var.location."
type = string
default = "eu-central"
}
variable "server_image" {
description = "OS image used for all servers."
type = string
default = "ubuntu-24.04"
}
variable "dev_server_type" {
description = "Server type for dev (Gitea + Runner)."
type = string
default = "cx22"
}
variable "prod_server_type" {
description = "Server type for prod (Traefik, Websites, Database, Bitwarden, Misc, Tracking, Rustdesk)."
type = string
default = "cx32"
}
variable "vpn_server_type" {
description = "Server type for vpn (OpenVPN + TraefikVPN)."
type = string
default = "cx22"
}
variable "dev_volume_size" {
description = "Size in GB of the volume attached to dev (disk2 in architecture.md)."
type = number
default = 50
}
variable "prod_volume_size" {
description = "Size in GB of the volume attached to prod (disk1 in architecture.md)."
type = number
default = 50
}
variable "network_ip_range" {
description = "IP range of the private network shared by dev and prod."
type = string
default = "10.0.0.0/16"
}
variable "subnet_ip_range" {
description = "IP range of the network subnet shared by dev and prod."
type = string
default = "10.0.1.0/24"
}
variable "dev_private_ip" {
description = "Private network IP for dev."
type = string
default = "10.0.1.10"
}
variable "prod_private_ip" {
description = "Private network IP for prod."
type = string
default = "10.0.1.11"
}
variable "ssh_key_name" {
description = "Name of an SSH key already uploaded to your Hetzner Cloud project (Console > Security > SSH Keys)."
type = string
}
variable "allowed_ssh_source_ips" {
description = "CIDRs allowed to reach port 22 on every server. Narrow this to your own IP(s) once known."
type = list(string)
default = ["0.0.0.0/0", "::/0"]
}
infra/versions.tf
+13
View File
@@ -0,0 +1,13 @@
terraform {
required_version = ">= 1.6.0"
required_providers {
hcloud = {
source = "hetznercloud/hcloud"
version = "~> 1.45"
}
}
}
# Reads the token from the HCLOUD_TOKEN environment variable.
provider "hcloud" {}
infra/volumes.tf
+17
View File
@@ -0,0 +1,17 @@
# disk1 in architecture.md - attached to prod
resource "hcloud_volume" "prod_storage" {
name = "prod-storage"
size = var.prod_volume_size
server_id = hcloud_server.prod.id
automount = true
format = "ext4"
}
# disk2 in architecture.md - attached to dev
resource "hcloud_volume" "dev_storage" {
name = "dev-storage"
size = var.dev_volume_size
server_id = hcloud_server.dev.id
automount = true
format = "ext4"
}