chore: Restructured infra modules

infra/main.tf

@@ -0,0 +1,55 @@
+# Root module: wires together the shared network and the three host modules
+# (one per server in docs/architecture.md). Each host module owns its own
+# firewall (and volume, where applicable) - see modules/<host>/main.tf.
+
+module "network" {
+  source = "./modules/network"
+
+  ip_range        = var.network_ip_range
+  network_zone    = var.network_zone
+  subnet_ip_range = var.subnet_ip_range
+}
+
+module "dev" {
+  source = "./modules/dev"
+
+  server_type            = var.dev_server_type
+  image                  = var.server_image
+  location               = var.location
+  ssh_key_id             = data.hcloud_ssh_key.main.id
+  network_id             = module.network.id
+  private_ip             = var.dev_private_ip
+  volume_size            = var.dev_volume_size
+  allowed_ssh_source_ips = var.allowed_ssh_source_ips
+  network_ip_range       = var.network_ip_range
+
+  # module.network.id alone doesn't guarantee the subnet exists yet, and a server
+  # can't join a network before it has a subnet.
+  depends_on = [module.network]
+}
+
+module "prod" {
+  source = "./modules/prod"
+
+  server_type            = var.prod_server_type
+  image                  = var.server_image
+  location               = var.location
+  ssh_key_id             = data.hcloud_ssh_key.main.id
+  network_id             = module.network.id
+  private_ip             = var.prod_private_ip
+  volume_size            = var.prod_volume_size
+  allowed_ssh_source_ips = var.allowed_ssh_source_ips
+  network_ip_range       = var.network_ip_range
+
+  depends_on = [module.network]
+}
+
+module "vpn" {
+  source = "./modules/vpn"
+
+  server_type            = var.vpn_server_type
+  image                  = var.server_image
+  location               = var.location
+  ssh_key_id             = data.hcloud_ssh_key.main.id
+  allowed_ssh_source_ips = var.allowed_ssh_source_ips
+}