From a7cfcc33cea1f286265aa63ae434acfcffba0e91 Mon Sep 17 00:00:00 2001 From: Luke Else Date: Fri, 10 Jul 2026 20:54:22 +0100 Subject: [PATCH] chore: Restructured infra modules --- infra/.terraform.lock.hcl | 32 ++++ infra/firewalls.tf | 155 ------------------ infra/main.tf | 55 +++++++ infra/modules/dev/main.tf | 72 ++++++++ infra/modules/dev/outputs.tf | 7 + infra/modules/dev/variables.tf | 44 +++++ infra/{network.tf => modules/network/main.tf} | 4 +- infra/modules/network/outputs.tf | 9 + infra/modules/network/variables.tf | 14 ++ infra/modules/prod/main.tf | 106 ++++++++++++ infra/modules/prod/outputs.tf | 7 + infra/modules/prod/variables.tf | 44 +++++ infra/modules/vpn/main.tf | 41 +++++ infra/modules/vpn/outputs.tf | 3 + infra/modules/vpn/variables.tf | 24 +++ infra/outputs.tf | 10 +- infra/servers.tf | 43 ----- infra/variables.tf | 16 +- infra/volumes.tf | 17 -- 19 files changed, 473 insertions(+), 230 deletions(-) delete mode 100644 infra/firewalls.tf create mode 100644 infra/main.tf create mode 100644 infra/modules/dev/main.tf create mode 100644 infra/modules/dev/outputs.tf create mode 100644 infra/modules/dev/variables.tf rename infra/{network.tf => modules/network/main.tf} (74%) create mode 100644 infra/modules/network/outputs.tf create mode 100644 infra/modules/network/variables.tf create mode 100644 infra/modules/prod/main.tf create mode 100644 infra/modules/prod/outputs.tf create mode 100644 infra/modules/prod/variables.tf create mode 100644 infra/modules/vpn/main.tf create mode 100644 infra/modules/vpn/outputs.tf create mode 100644 infra/modules/vpn/variables.tf delete mode 100644 infra/servers.tf delete mode 100644 infra/volumes.tf diff --git a/infra/.terraform.lock.hcl b/infra/.terraform.lock.hcl index 37ba449..8927fa3 100644 --- a/infra/.terraform.lock.hcl +++ b/infra/.terraform.lock.hcl @@ -1,6 +1,38 @@ # This file is maintained automatically by "tofu init". # Manual edits may be lost in future updates. +provider "registry.opentofu.org/hashicorp/hcloud" { + version = "1.66.0" + hashes = [ + "h1:+R3t/5wqCb2ics5bNZ4JgtfaAa08Z6uRzXzNtwovVEY=", + "h1:9c1ECk3N9xhdQKz4NVCfYEFxebJVVeQZS3E6wrR/Hx8=", + "h1:EtYB/KjPN2cIJa6hpEaVc8q/3yf6e9IT6/uAybUGqps=", + "h1:GUupu6Fg5zFY9i4/3esiy8uHZnUrt+u2B6NaE4+8YqQ=", + "h1:JHehRJySEFRGYK+D6pFS0MTTDDRlGSQdSaKdEo0AemA=", + "h1:XF+SwyO1ttQJ0WXJ5O628O7cGk9U37sGn0o3LwWUnDQ=", + "h1:czuvCXAd8CcszXh3k3E0N6tFfQkYSNbKXo99LG+yOIc=", + "h1:dPIwO6zTxYs6bHn5yf/w/1AExaHPppCLyTrWrdzH4RE=", + "h1:gqrhnYuIBzpUvgWHITNRUMLaDcKACGlrNfrbtbtO7KY=", + "h1:iVAGP8gRbZK0kJF7SiYJRt61wz0D5AF9q+WMsrAiBI0=", + "h1:kLi29SbGCU/Z/Ch0zuNdYFSKP3mHp8zfcOpZsIN/KIQ=", + "h1:mq2+1Q/5gWJYI8XOXQCeteUg0AP7VezPOGOjkkHRQso=", + "h1:rnWTWAOlJhHtD3kkU4Qfw0bg9ko/dlH822inxYLBmfQ=", + "zh:1286cee6fb63dbcb18f53077bbb5e5d132a4e4d9f006af4e8d8edfc08d6bcdc8", + "zh:204460dacc044bda019a4a18b398e094289500c36913c7c9457f432adf31b8b2", + "zh:214175d50773481cbeaf9c9004e4121a3a1c9686c79424ebdc8ff189dd057d3e", + "zh:22b17bceff61cc13ad04a399ba87521356a3a134d4687273727473ae9eccf5f1", + "zh:368867dac5525c411de7e38f2e27de0a71854d1750867322ff2b9321128c88fb", + "zh:5289b75f8370bdbc4c6051d55cf33d0b1bd25dc6d71bfbd39b360249a37f1501", + "zh:81cb676aa50c5777df8fc80d4e69c9012330ae751f5e6f12bf6074bfd2e7c496", + "zh:ab08aead10643b21aa6b51af562b50492e12b9dd0ab7dca27a05aa63209b7d66", + "zh:af25c210d0570cf61ef767b2545bf9f3fb909178135f0e5e14bec0c1c9d07a63", + "zh:bcad66f4830c97118fa793723e53f8a4d27ddd34ea969ff259408842c2238331", + "zh:ce3ed323d75ae905d975925fa98c7054a7514c81276a485fc37da8232b53e39f", + "zh:d481bc0ef0c87ab1969c17777f526b2f59f823432d676145134c41a6d29bd98e", + "zh:ea7ef88df2c3ca154d86238920636d52a3c9066c7467543d3fa45f1e52ec2f7b", + ] +} + provider "registry.opentofu.org/hetznercloud/hcloud" { version = "1.66.0" constraints = "~> 1.45" diff --git a/infra/firewalls.tf b/infra/firewalls.tf deleted file mode 100644 index 55528ad..0000000 --- a/infra/firewalls.tf +++ /dev/null @@ -1,155 +0,0 @@ -# Port sources: services/*/docker-compose.yml (published ports) and services/todo.md -# (the documented UFW allow-list). dev has no firewall in architecture.md, but we add -# one anyway for baseline safety - see conversation history. - -resource "hcloud_firewall" "dev" { - name = "dev-firewall" - - rule { # server ssh - direction = "in" - protocol = "tcp" - port = "22" - source_ips = var.allowed_ssh_source_ips - } - - rule { # gitea ssh (git.luke-else.co.uk, published as 222:22) - direction = "in" - protocol = "tcp" - port = "222" - source_ips = ["0.0.0.0/0", "::/0"] - } - - rule { # TraefikRunner http/https (git.luke-else.co.uk, cicd.luke-else.co.uk) - direction = "in" - protocol = "tcp" - port = "80" - source_ips = ["0.0.0.0/0", "::/0"] - } - - rule { - direction = "in" - protocol = "tcp" - port = "443" - source_ips = ["0.0.0.0/0", "::/0"] - } - - rule { # traffic from prod over the private network - direction = "in" - protocol = "tcp" - port = "1-65535" - source_ips = [var.network_ip_range] - } - - rule { - direction = "in" - protocol = "udp" - port = "1-65535" - source_ips = [var.network_ip_range] - } -} - -resource "hcloud_firewall" "prod" { - name = "prod-firewall" - - rule { # server ssh - direction = "in" - protocol = "tcp" - port = "22" - source_ips = var.allowed_ssh_source_ips - } - - rule { # Traefik http/https (Websites, Bitwarden, Misc, Tracking) - direction = "in" - protocol = "tcp" - port = "80" - source_ips = ["0.0.0.0/0", "::/0"] - } - - rule { - direction = "in" - protocol = "tcp" - port = "443" - source_ips = ["0.0.0.0/0", "::/0"] - } - - rule { # rustdesk hbbs - direction = "in" - protocol = "tcp" - port = "21115" - source_ips = ["0.0.0.0/0", "::/0"] - } - - rule { - direction = "in" - protocol = "tcp" - port = "21116" - source_ips = ["0.0.0.0/0", "::/0"] - } - - rule { - direction = "in" - protocol = "udp" - port = "21116" - source_ips = ["0.0.0.0/0", "::/0"] - } - - rule { # rustdesk hbbr - direction = "in" - protocol = "tcp" - port = "21117" - source_ips = ["0.0.0.0/0", "::/0"] - } - - rule { - direction = "in" - protocol = "tcp" - port = "21119" - source_ips = ["0.0.0.0/0", "::/0"] - } - - rule { # traffic from dev over the private network - direction = "in" - protocol = "tcp" - port = "1-65535" - source_ips = [var.network_ip_range] - } - - rule { - direction = "in" - protocol = "udp" - port = "1-65535" - source_ips = [var.network_ip_range] - } -} - -resource "hcloud_firewall" "vpn" { - name = "vpn-firewall" - - rule { # server ssh - direction = "in" - protocol = "tcp" - port = "22" - source_ips = var.allowed_ssh_source_ips - } - - rule { # TraefikVPN http/https (traefik.vpn.luke-else.co.uk) - direction = "in" - protocol = "tcp" - port = "80" - source_ips = ["0.0.0.0/0", "::/0"] - } - - rule { - direction = "in" - protocol = "tcp" - port = "443" - source_ips = ["0.0.0.0/0", "::/0"] - } - - rule { # OpenVPN tunnel - always direct to this server's public IP, never via a load balancer - direction = "in" - protocol = "udp" - port = "1194" - source_ips = ["0.0.0.0/0", "::/0"] - } -} diff --git a/infra/main.tf b/infra/main.tf new file mode 100644 index 0000000..6821232 --- /dev/null +++ b/infra/main.tf @@ -0,0 +1,55 @@ +# Root module: wires together the shared network and the three host modules +# (one per server in docs/architecture.md). Each host module owns its own +# firewall (and volume, where applicable) - see modules//main.tf. + +module "network" { + source = "./modules/network" + + ip_range = var.network_ip_range + network_zone = var.network_zone + subnet_ip_range = var.subnet_ip_range +} + +module "dev" { + source = "./modules/dev" + + server_type = var.dev_server_type + image = var.server_image + location = var.location + ssh_key_id = data.hcloud_ssh_key.main.id + network_id = module.network.id + private_ip = var.dev_private_ip + volume_size = var.dev_volume_size + allowed_ssh_source_ips = var.allowed_ssh_source_ips + network_ip_range = var.network_ip_range + + # module.network.id alone doesn't guarantee the subnet exists yet, and a server + # can't join a network before it has a subnet. + depends_on = [module.network] +} + +module "prod" { + source = "./modules/prod" + + server_type = var.prod_server_type + image = var.server_image + location = var.location + ssh_key_id = data.hcloud_ssh_key.main.id + network_id = module.network.id + private_ip = var.prod_private_ip + volume_size = var.prod_volume_size + allowed_ssh_source_ips = var.allowed_ssh_source_ips + network_ip_range = var.network_ip_range + + depends_on = [module.network] +} + +module "vpn" { + source = "./modules/vpn" + + server_type = var.vpn_server_type + image = var.server_image + location = var.location + ssh_key_id = data.hcloud_ssh_key.main.id + allowed_ssh_source_ips = var.allowed_ssh_source_ips +} diff --git a/infra/modules/dev/main.tf b/infra/modules/dev/main.tf new file mode 100644 index 0000000..90552be --- /dev/null +++ b/infra/modules/dev/main.tf @@ -0,0 +1,72 @@ +# dev: Gitea + Runner + Traefik (git.luke-else.co.uk, cicd.luke-else.co.uk) + +# Port sources: services/dev/*docker-compose.yml (published ports) and services/todo.md +# (the documented UFW allow-list). dev has no firewall in docs/architecture.md, but we +# add one anyway for baseline safety - see conversation history. +resource "hcloud_firewall" "this" { + name = "dev-firewall" + + rule { # server ssh + direction = "in" + protocol = "tcp" + port = "22" + source_ips = var.allowed_ssh_source_ips + } + + rule { # gitea ssh (git.luke-else.co.uk, published as 222:22) + direction = "in" + protocol = "tcp" + port = "222" + source_ips = ["0.0.0.0/0", "::/0"] + } + + rule { # Traefik http/https (git.luke-else.co.uk, cicd.luke-else.co.uk) + direction = "in" + protocol = "tcp" + port = "80" + source_ips = ["0.0.0.0/0", "::/0"] + } + + rule { + direction = "in" + protocol = "tcp" + port = "443" + source_ips = ["0.0.0.0/0", "::/0"] + } + + rule { # traffic from prod over the private network + direction = "in" + protocol = "tcp" + port = "1-65535" + source_ips = [var.network_ip_range] + } + + rule { + direction = "in" + protocol = "udp" + port = "1-65535" + source_ips = [var.network_ip_range] + } +} + +resource "hcloud_server" "this" { + name = "dev" + server_type = var.server_type + image = var.image + location = var.location + ssh_keys = [var.ssh_key_id] + firewall_ids = [hcloud_firewall.this.id] + + network { + network_id = var.network_id + ip = var.private_ip + } +} + +resource "hcloud_volume" "storage" { + name = "dev-storage" + size = var.volume_size + server_id = hcloud_server.this.id + automount = true + format = "ext4" +} diff --git a/infra/modules/dev/outputs.tf b/infra/modules/dev/outputs.tf new file mode 100644 index 0000000..4897389 --- /dev/null +++ b/infra/modules/dev/outputs.tf @@ -0,0 +1,7 @@ +output "ipv4" { + value = hcloud_server.this.ipv4_address +} + +output "private_ipv4" { + value = var.private_ip +} diff --git a/infra/modules/dev/variables.tf b/infra/modules/dev/variables.tf new file mode 100644 index 0000000..7c0cd9f --- /dev/null +++ b/infra/modules/dev/variables.tf @@ -0,0 +1,44 @@ +variable "server_type" { + description = "Server type for dev (Gitea + Runner)." + type = string +} + +variable "image" { + description = "OS image used for the server." + type = string +} + +variable "location" { + description = "Hetzner Cloud datacenter location." + type = string +} + +variable "ssh_key_id" { + description = "ID of the Hetzner Cloud SSH key to install on the server." + type = string +} + +variable "network_id" { + description = "ID of the private network to attach dev to." + type = string +} + +variable "private_ip" { + description = "Private network IP for dev." + type = string +} + +variable "volume_size" { + description = "Size in GB of the volume attached to dev (disk2 in docs/architecture.md)." + type = number +} + +variable "allowed_ssh_source_ips" { + description = "CIDRs allowed to reach port 22 on dev." + type = list(string) +} + +variable "network_ip_range" { + description = "CIDR of the private network, allowed through the firewall for traffic from prod." + type = string +} diff --git a/infra/network.tf b/infra/modules/network/main.tf similarity index 74% rename from infra/network.tf rename to infra/modules/network/main.tf index 29fad1b..87abcb8 100644 --- a/infra/network.tf +++ b/infra/modules/network/main.tf @@ -1,8 +1,8 @@ -# Private network shared by dev and prod (see architecture.md "network" group). +# Private network shared by dev and prod (see docs/architecture.md "network" group). # vpn is intentionally not attached to this network - it sits outside it in the diagram. resource "hcloud_network" "main" { name = "server-network" - ip_range = var.network_ip_range + ip_range = var.ip_range } resource "hcloud_network_subnet" "main" { diff --git a/infra/modules/network/outputs.tf b/infra/modules/network/outputs.tf new file mode 100644 index 0000000..622ad92 --- /dev/null +++ b/infra/modules/network/outputs.tf @@ -0,0 +1,9 @@ +output "id" { + value = hcloud_network.main.id +} + +# Exposed so dependents can depend_on the subnet existing, not just the network - +# attaching a server to a network fails if the network has no subnet yet. +output "subnet_id" { + value = hcloud_network_subnet.main.id +} diff --git a/infra/modules/network/variables.tf b/infra/modules/network/variables.tf new file mode 100644 index 0000000..ba05090 --- /dev/null +++ b/infra/modules/network/variables.tf @@ -0,0 +1,14 @@ +variable "ip_range" { + description = "IP range of the private network shared by dev and prod." + type = string +} + +variable "network_zone" { + description = "Hetzner Cloud network zone matching var.location." + type = string +} + +variable "subnet_ip_range" { + description = "IP range of the network subnet shared by dev and prod." + type = string +} diff --git a/infra/modules/prod/main.tf b/infra/modules/prod/main.tf new file mode 100644 index 0000000..4f1d733 --- /dev/null +++ b/infra/modules/prod/main.tf @@ -0,0 +1,106 @@ +# prod: Traefik, Websites, Bitwarden, RustDesk, status page + +# Port sources: services/prod/*docker-compose.yml (published ports) and services/todo.md +# (the documented UFW allow-list). +resource "hcloud_firewall" "this" { + name = "prod-firewall" + + rule { # server ssh + direction = "in" + protocol = "tcp" + port = "22" + source_ips = var.allowed_ssh_source_ips + } + + rule { # Traefik http/https (Websites, Bitwarden, status page) + direction = "in" + protocol = "tcp" + port = "80" + source_ips = ["0.0.0.0/0", "::/0"] + } + + rule { + direction = "in" + protocol = "tcp" + port = "443" + source_ips = ["0.0.0.0/0", "::/0"] + } + + rule { # mongo via Traefik tcp entrypoint + direction = "in" + protocol = "tcp" + port = "27017" + source_ips = ["0.0.0.0/0", "::/0"] + } + + rule { # rustdesk hbbs + direction = "in" + protocol = "tcp" + port = "21115" + source_ips = ["0.0.0.0/0", "::/0"] + } + + rule { + direction = "in" + protocol = "tcp" + port = "21116" + source_ips = ["0.0.0.0/0", "::/0"] + } + + rule { + direction = "in" + protocol = "udp" + port = "21116" + source_ips = ["0.0.0.0/0", "::/0"] + } + + rule { # rustdesk hbbr + direction = "in" + protocol = "tcp" + port = "21117" + source_ips = ["0.0.0.0/0", "::/0"] + } + + rule { + direction = "in" + protocol = "tcp" + port = "21119" + source_ips = ["0.0.0.0/0", "::/0"] + } + + rule { # traffic from dev over the private network + direction = "in" + protocol = "tcp" + port = "1-65535" + source_ips = [var.network_ip_range] + } + + rule { + direction = "in" + protocol = "udp" + port = "1-65535" + source_ips = [var.network_ip_range] + } +} + +resource "hcloud_server" "this" { + name = "prod" + server_type = var.server_type + image = var.image + location = var.location + ssh_keys = [var.ssh_key_id] + firewall_ids = [hcloud_firewall.this.id] + + network { + network_id = var.network_id + ip = var.private_ip + } +} + +resource "hcloud_volume" "storage" { + name = "prod-storage" + size = var.volume_size + server_id = hcloud_server.this.id + automount = true + format = "ext4" +} diff --git a/infra/modules/prod/outputs.tf b/infra/modules/prod/outputs.tf new file mode 100644 index 0000000..4897389 --- /dev/null +++ b/infra/modules/prod/outputs.tf @@ -0,0 +1,7 @@ +output "ipv4" { + value = hcloud_server.this.ipv4_address +} + +output "private_ipv4" { + value = var.private_ip +} diff --git a/infra/modules/prod/variables.tf b/infra/modules/prod/variables.tf new file mode 100644 index 0000000..6acee71 --- /dev/null +++ b/infra/modules/prod/variables.tf @@ -0,0 +1,44 @@ +variable "server_type" { + description = "Server type for prod (Traefik, Websites, Bitwarden, RustDesk, status page)." + type = string +} + +variable "image" { + description = "OS image used for the server." + type = string +} + +variable "location" { + description = "Hetzner Cloud datacenter location." + type = string +} + +variable "ssh_key_id" { + description = "ID of the Hetzner Cloud SSH key to install on the server." + type = string +} + +variable "network_id" { + description = "ID of the private network to attach prod to." + type = string +} + +variable "private_ip" { + description = "Private network IP for prod." + type = string +} + +variable "volume_size" { + description = "Size in GB of the volume attached to prod (disk1 in docs/architecture.md)." + type = number +} + +variable "allowed_ssh_source_ips" { + description = "CIDRs allowed to reach port 22 on prod." + type = list(string) +} + +variable "network_ip_range" { + description = "CIDR of the private network, allowed through the firewall for traffic from dev." + type = string +} diff --git a/infra/modules/vpn/main.tf b/infra/modules/vpn/main.tf new file mode 100644 index 0000000..e0b6953 --- /dev/null +++ b/infra/modules/vpn/main.tf @@ -0,0 +1,41 @@ +# vpn: OpenVPN + Traefik. Not attached to the private network (see docs/architecture.md). +resource "hcloud_firewall" "this" { + name = "vpn-firewall" + + rule { # server ssh + direction = "in" + protocol = "tcp" + port = "22" + source_ips = var.allowed_ssh_source_ips + } + + rule { # Traefik http/https (traefik.vpn.luke-else.co.uk) + direction = "in" + protocol = "tcp" + port = "80" + source_ips = ["0.0.0.0/0", "::/0"] + } + + rule { + direction = "in" + protocol = "tcp" + port = "443" + source_ips = ["0.0.0.0/0", "::/0"] + } + + rule { # OpenVPN tunnel - always direct to this server's public IP, never via a load balancer + direction = "in" + protocol = "udp" + port = "1194" + source_ips = ["0.0.0.0/0", "::/0"] + } +} + +resource "hcloud_server" "this" { + name = "vpn" + server_type = var.server_type + image = var.image + location = var.location + ssh_keys = [var.ssh_key_id] + firewall_ids = [hcloud_firewall.this.id] +} diff --git a/infra/modules/vpn/outputs.tf b/infra/modules/vpn/outputs.tf new file mode 100644 index 0000000..8952de2 --- /dev/null +++ b/infra/modules/vpn/outputs.tf @@ -0,0 +1,3 @@ +output "ipv4" { + value = hcloud_server.this.ipv4_address +} diff --git a/infra/modules/vpn/variables.tf b/infra/modules/vpn/variables.tf new file mode 100644 index 0000000..75c7fb8 --- /dev/null +++ b/infra/modules/vpn/variables.tf @@ -0,0 +1,24 @@ +variable "server_type" { + description = "Server type for vpn (OpenVPN + Traefik)." + type = string +} + +variable "image" { + description = "OS image used for the server." + type = string +} + +variable "location" { + description = "Hetzner Cloud datacenter location." + type = string +} + +variable "ssh_key_id" { + description = "ID of the Hetzner Cloud SSH key to install on the server." + type = string +} + +variable "allowed_ssh_source_ips" { + description = "CIDRs allowed to reach port 22 on vpn." + type = list(string) +} diff --git a/infra/outputs.tf b/infra/outputs.tf index 68041a3..989bf4c 100644 --- a/infra/outputs.tf +++ b/infra/outputs.tf @@ -1,19 +1,19 @@ output "dev_ipv4" { - value = hcloud_server.dev.ipv4_address + value = module.dev.ipv4 } output "dev_private_ipv4" { - value = var.dev_private_ip + value = module.dev.private_ipv4 } output "prod_ipv4" { - value = hcloud_server.prod.ipv4_address + value = module.prod.ipv4 } output "prod_private_ipv4" { - value = var.prod_private_ip + value = module.prod.private_ipv4 } output "vpn_ipv4" { - value = hcloud_server.vpn.ipv4_address + value = module.vpn.ipv4 } diff --git a/infra/servers.tf b/infra/servers.tf deleted file mode 100644 index 18bb96f..0000000 --- a/infra/servers.tf +++ /dev/null @@ -1,43 +0,0 @@ -# dev: Gitea + Runner + TraefikRunner (git.luke-else.co.uk, cicd.luke-else.co.uk) -resource "hcloud_server" "dev" { - name = "dev" - server_type = var.dev_server_type - image = var.server_image - location = var.location - ssh_keys = [data.hcloud_ssh_key.main.id] - firewall_ids = [hcloud_firewall.dev.id] - - network { - network_id = hcloud_network.main.id - ip = var.dev_private_ip - } - - depends_on = [hcloud_network_subnet.main] -} - -# prod: Traefik, Websites, Database, Bitwarden, Misc, Tracking, Rustdesk -resource "hcloud_server" "prod" { - name = "prod" - server_type = var.prod_server_type - image = var.server_image - location = var.location - ssh_keys = [data.hcloud_ssh_key.main.id] - firewall_ids = [hcloud_firewall.prod.id] - - network { - network_id = hcloud_network.main.id - ip = var.prod_private_ip - } - - depends_on = [hcloud_network_subnet.main] -} - -# vpn: OpenVPN + TraefikVPN. Not attached to the private network (see architecture.md). -resource "hcloud_server" "vpn" { - name = "vpn" - server_type = var.vpn_server_type - image = var.server_image - location = var.location - ssh_keys = [data.hcloud_ssh_key.main.id] - firewall_ids = [hcloud_firewall.vpn.id] -} diff --git a/infra/variables.tf b/infra/variables.tf index 53478de..020d0c9 100644 --- a/infra/variables.tf +++ b/infra/variables.tf @@ -17,33 +17,33 @@ variable "server_image" { } variable "dev_server_type" { - description = "Server type for dev (Gitea + Runner)." + description = "Server type for dev" type = string default = "cx22" } variable "prod_server_type" { - description = "Server type for prod (Traefik, Websites, Database, Bitwarden, Misc, Tracking, Rustdesk)." + description = "Server type for prod" type = string - default = "cx32" + default = "cx22" } variable "vpn_server_type" { - description = "Server type for vpn (OpenVPN + TraefikVPN)." + description = "Server type for vpn" type = string default = "cx22" } variable "dev_volume_size" { - description = "Size in GB of the volume attached to dev (disk2 in architecture.md)." + description = "Size in GB of the volume attached to dev" type = number - default = 50 + default = 20 } variable "prod_volume_size" { - description = "Size in GB of the volume attached to prod (disk1 in architecture.md)." + description = "Size in GB of the volume attached to prod (disk1 in docs/architecture.md)." type = number - default = 50 + default = 20 } variable "network_ip_range" { diff --git a/infra/volumes.tf b/infra/volumes.tf deleted file mode 100644 index 5a8863c..0000000 --- a/infra/volumes.tf +++ /dev/null @@ -1,17 +0,0 @@ -# disk1 in architecture.md - attached to prod -resource "hcloud_volume" "prod_storage" { - name = "prod-storage" - size = var.prod_volume_size - server_id = hcloud_server.prod.id - automount = true - format = "ext4" -} - -# disk2 in architecture.md - attached to dev -resource "hcloud_volume" "dev_storage" { - name = "dev-storage" - size = var.dev_volume_size - server_id = hcloud_server.dev.id - automount = true - format = "ext4" -}