feat: Added terraform config... just a basic one at first

2026-07-09 21:55:50 +01:00
parent 5486716981
commit 3bfa0e6f32
33 changed files with 1235 additions and 5 deletions
@@ -0,0 +1,162 @@
+# Port sources: services/*/docker-compose.yml (published ports) and services/todo.md
+# (the documented UFW allow-list). dev has no firewall in architecture.md, but we add
+# one anyway for baseline safety - see conversation history.
+
+resource "hcloud_firewall" "dev" {
+  name = "dev-firewall"
+
+  rule { # server ssh
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "22"
+    source_ips = var.allowed_ssh_source_ips
+  }
+
+  rule { # gitea ssh (git.luke-else.co.uk, published as 222:22)
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "222"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule { # TraefikRunner http/https (git.luke-else.co.uk, cicd.luke-else.co.uk)
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "80"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule {
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "443"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule { # traffic from prod over the private network
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "1-65535"
+    source_ips = [var.network_ip_range]
+  }
+
+  rule {
+    direction  = "in"
+    protocol   = "udp"
+    port       = "1-65535"
+    source_ips = [var.network_ip_range]
+  }
+}
+
+resource "hcloud_firewall" "prod" {
+  name = "prod-firewall"
+
+  rule { # server ssh
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "22"
+    source_ips = var.allowed_ssh_source_ips
+  }
+
+  rule { # Traefik http/https (Websites, Bitwarden, Misc, Tracking)
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "80"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule {
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "443"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule { # mongo via Traefik tcp entrypoint (Database)
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "27017"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule { # rustdesk hbbs
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "21115"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule {
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "21116"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule {
+    direction  = "in"
+    protocol   = "udp"
+    port       = "21116"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule { # rustdesk hbbr
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "21117"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule {
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "21119"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule { # traffic from dev over the private network
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "1-65535"
+    source_ips = [var.network_ip_range]
+  }
+
+  rule {
+    direction  = "in"
+    protocol   = "udp"
+    port       = "1-65535"
+    source_ips = [var.network_ip_range]
+  }
+}
+
+resource "hcloud_firewall" "vpn" {
+  name = "vpn-firewall"
+
+  rule { # server ssh
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "22"
+    source_ips = var.allowed_ssh_source_ips
+  }
+
+  rule { # TraefikVPN http/https (traefik.vpn.luke-else.co.uk)
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "80"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule {
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "443"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule { # OpenVPN tunnel - always direct to this server's public IP, never via a load balancer
+    direction  = "in"
+    protocol   = "udp"
+    port       = "1194"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+}