luke-else/server
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

chore: Refresh of repo

Browse Source
This commit is contained in:
luke-else
2026-07-21 20:11:23 +01:00
parent a9d602f35e
commit 52aa4278bf
11 changed files with 92 additions and 222 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infra/modules/dev/main.tf
+5 -7
View File
@@ -1,26 +1,24 @@
# dev: Gitea + Runner + Traefik (git.luke-else.co.uk, cicd.luke-else.co.uk)
# Port sources: services/dev/*docker-compose.yml (published ports) and services/todo.md
# (the documented UFW allow-list). dev has no firewall in docs/architecture.md, but we
# add one anyway for baseline safety - see conversation history.
# Port sources: services/dev/*docker-compose.yml (published ports)
resource "hcloud_firewall" "this" {
name = "dev-firewall"
rule { # server ssh - wired to the vpn server's public IP only, see infra/main.tf
rule { # server ssh - wired to the vpn server's public IP only
direction = "in"
protocol = "tcp"
port = "22"
source_ips = var.allowed_ssh_source_ips
}
rule { # gitea ssh (git.luke-else.co.uk, published as 222:22)
rule { # gitea ssh
direction = "in"
protocol = "tcp"
port = "222"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule { # Traefik http/https (git.luke-else.co.uk, cicd.luke-else.co.uk)
rule { # Traefik http/https
direction = "in"
protocol = "tcp"
port = "80"
@@ -56,7 +54,7 @@ resource "hcloud_server" "this" {
location = var.location
ssh_keys = var.ssh_key_ids
firewall_ids = [hcloud_firewall.this.id]
labels = { role = "dev" } # picked up by ansible/inventory/hcloud.yml
labels = { role = "dev" }
network {
network_id = var.network_id