luke-else/server
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

chore: Refresh of repo

Browse Source
This commit is contained in:
luke-else
2026-07-21 20:11:23 +01:00
parent a9d602f35e
commit 52aa4278bf
11 changed files with 92 additions and 222 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infra/main.tf
+1 -4
View File
@@ -32,10 +32,7 @@ locals {
{ zone = "luke-else.co.uk", name = "traefik.vpn", value = module.vpn.ipv4 },
]
# Microsoft 365 mail records for luke-else.co.uk - carried over from the
# domain's old DNS provider (pre-Hetzner), not previously applied here, so
# these are genuinely new to the Hetzner zone rather than something to
# import.
# Microsoft 365 mail records for luke-else.co.uk
mail_records = [
{ zone = "luke-else.co.uk", name = "@", type = "MX", value = "0 lukeelse-co-uk01b.mail.protection.outlook.com." },
{ zone = "luke-else.co.uk", name = "@", type = "TXT", value = "\"v=spf1 include:spf.protection.outlook.com -all\"" },
infra/modules/dev/main.tf
+5 -7
View File
@@ -1,26 +1,24 @@
# dev: Gitea + Runner + Traefik (git.luke-else.co.uk, cicd.luke-else.co.uk)
# Port sources: services/dev/*docker-compose.yml (published ports) and services/todo.md
# (the documented UFW allow-list). dev has no firewall in docs/architecture.md, but we
# add one anyway for baseline safety - see conversation history.
# Port sources: services/dev/*docker-compose.yml (published ports)
resource "hcloud_firewall" "this" {
name = "dev-firewall"
rule { # server ssh - wired to the vpn server's public IP only, see infra/main.tf
rule { # server ssh - wired to the vpn server's public IP only
direction = "in"
protocol = "tcp"
port = "22"
source_ips = var.allowed_ssh_source_ips
}
rule { # gitea ssh (git.luke-else.co.uk, published as 222:22)
rule { # gitea ssh
direction = "in"
protocol = "tcp"
port = "222"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule { # Traefik http/https (git.luke-else.co.uk, cicd.luke-else.co.uk)
rule { # Traefik http/https
direction = "in"
protocol = "tcp"
port = "80"
@@ -56,7 +54,7 @@ resource "hcloud_server" "this" {
location = var.location
ssh_keys = var.ssh_key_ids
firewall_ids = [hcloud_firewall.this.id]
labels = { role = "dev" } # picked up by ansible/inventory/hcloud.yml
labels = { role = "dev" }
network {
network_id = var.network_id
infra/modules/network/main.tf
+2 -2
View File
@@ -1,5 +1,5 @@
# Private network shared by dev and prod (see docs/architecture.md "network" group).
# vpn is intentionally not attached to this network - it sits outside it in the diagram.
# Private network shared by dev and prod (see readme.md "network" group).
# vpn is intentionally not attached to this network
resource "hcloud_network" "main" {
name = "server-network"
ip_range = var.ip_range
infra/modules/prod/main.tf
+5 -8
View File
@@ -1,18 +1,15 @@
# prod: Traefik, Websites, Bitwarden, RustDesk, status page
# Port sources: services/prod/*docker-compose.yml (published ports) and services/todo.md
# (the documented UFW allow-list).
# Port sources: services/prod/*docker-compose.yml (published ports)
resource "hcloud_firewall" "this" {
name = "prod-firewall"
rule { # server ssh - wired to the vpn server's public IP only, see infra/main.tf
rule { # server ssh - wired to the vpn server's public IP only
direction = "in"
protocol = "tcp"
port = "22"
source_ips = var.allowed_ssh_source_ips
}
rule { # Traefik http/https (Websites, Bitwarden, status page)
rule { # Traefik http/https
direction = "in"
protocol = "tcp"
port = "80"
@@ -61,7 +58,7 @@ resource "hcloud_firewall" "this" {
source_ips = ["0.0.0.0/0", "::/0"]
}
rule { # traffic from dev over the private network
rule { # traffic from over the private network
direction = "in"
protocol = "tcp"
port = "1-65535"
@@ -83,7 +80,7 @@ resource "hcloud_server" "this" {
location = var.location
ssh_keys = var.ssh_key_ids
firewall_ids = [hcloud_firewall.this.id]
labels = { role = "prod" } # picked up by ansible/inventory/hcloud.yml
labels = { role = "prod" }
network {
network_id = var.network_id
infra/modules/vpn/main.tf
+3 -3
View File
@@ -1,4 +1,4 @@
# vpn: WireGuard (wg-easy) + Traefik. Not attached to the private network (see docs/architecture.md).
# vpn: WireGuard (wg-easy) + Traefik. Not attached to the private network.
resource "hcloud_firewall" "this" {
name = "vpn-firewall"
@@ -9,7 +9,7 @@ resource "hcloud_firewall" "this" {
source_ips = var.allowed_ssh_source_ips
}
rule { # Traefik http/https (traefik.vpn.luke-else.co.uk)
rule { # Traefik http/https
direction = "in"
protocol = "tcp"
port = "80"
@@ -38,5 +38,5 @@ resource "hcloud_server" "this" {
location = var.location
ssh_keys = var.ssh_key_ids
firewall_ids = [hcloud_firewall.this.id]
labels = { role = "vpn" } # picked up by ansible/inventory/hcloud.yml
labels = { role = "vpn" }
}