chore: Restructured infra modules

infra/modules/dev/main.tf

@@ -0,0 +1,72 @@
+# dev: Gitea + Runner + Traefik (git.luke-else.co.uk, cicd.luke-else.co.uk)
+
+# Port sources: services/dev/*docker-compose.yml (published ports) and services/todo.md
+# (the documented UFW allow-list). dev has no firewall in docs/architecture.md, but we
+# add one anyway for baseline safety - see conversation history.
+resource "hcloud_firewall" "this" {
+  name = "dev-firewall"
+
+  rule { # server ssh
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "22"
+    source_ips = var.allowed_ssh_source_ips
+  }
+
+  rule { # gitea ssh (git.luke-else.co.uk, published as 222:22)
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "222"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule { # Traefik http/https (git.luke-else.co.uk, cicd.luke-else.co.uk)
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "80"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule {
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "443"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule { # traffic from prod over the private network
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "1-65535"
+    source_ips = [var.network_ip_range]
+  }
+
+  rule {
+    direction  = "in"
+    protocol   = "udp"
+    port       = "1-65535"
+    source_ips = [var.network_ip_range]
+  }
+}
+
+resource "hcloud_server" "this" {
+  name         = "dev"
+  server_type  = var.server_type
+  image        = var.image
+  location     = var.location
+  ssh_keys     = [var.ssh_key_id]
+  firewall_ids = [hcloud_firewall.this.id]
+
+  network {
+    network_id = var.network_id
+    ip         = var.private_ip
+  }
+}
+
+resource "hcloud_volume" "storage" {
+  name      = "dev-storage"
+  size      = var.volume_size
+  server_id = hcloud_server.this.id
+  automount = true
+  format    = "ext4"
+}

infra/modules/dev/outputs.tf

@@ -0,0 +1,7 @@
+output "ipv4" {
+  value = hcloud_server.this.ipv4_address
+}
+
+output "private_ipv4" {
+  value = var.private_ip
+}

infra/modules/dev/variables.tf

@@ -0,0 +1,44 @@
+variable "server_type" {
+  description = "Server type for dev (Gitea + Runner)."
+  type        = string
+}
+
+variable "image" {
+  description = "OS image used for the server."
+  type        = string
+}
+
+variable "location" {
+  description = "Hetzner Cloud datacenter location."
+  type        = string
+}
+
+variable "ssh_key_id" {
+  description = "ID of the Hetzner Cloud SSH key to install on the server."
+  type        = string
+}
+
+variable "network_id" {
+  description = "ID of the private network to attach dev to."
+  type        = string
+}
+
+variable "private_ip" {
+  description = "Private network IP for dev."
+  type        = string
+}
+
+variable "volume_size" {
+  description = "Size in GB of the volume attached to dev (disk2 in docs/architecture.md)."
+  type        = number
+}
+
+variable "allowed_ssh_source_ips" {
+  description = "CIDRs allowed to reach port 22 on dev."
+  type        = list(string)
+}
+
+variable "network_ip_range" {
+  description = "CIDR of the private network, allowed through the firewall for traffic from prod."
+  type        = string
+}

infra/modules/network/main.tf

@@ -0,0 +1,13 @@
+# Private network shared by dev and prod (see docs/architecture.md "network" group).
+# vpn is intentionally not attached to this network - it sits outside it in the diagram.
+resource "hcloud_network" "main" {
+  name     = "server-network"
+  ip_range = var.ip_range
+}
+
+resource "hcloud_network_subnet" "main" {
+  network_id   = hcloud_network.main.id
+  type         = "cloud"
+  network_zone = var.network_zone
+  ip_range     = var.subnet_ip_range
+}

infra/modules/network/outputs.tf

@@ -0,0 +1,9 @@
+output "id" {
+  value = hcloud_network.main.id
+}
+
+# Exposed so dependents can depend_on the subnet existing, not just the network -
+# attaching a server to a network fails if the network has no subnet yet.
+output "subnet_id" {
+  value = hcloud_network_subnet.main.id
+}

infra/modules/network/variables.tf

@@ -0,0 +1,14 @@
+variable "ip_range" {
+  description = "IP range of the private network shared by dev and prod."
+  type        = string
+}
+
+variable "network_zone" {
+  description = "Hetzner Cloud network zone matching var.location."
+  type        = string
+}
+
+variable "subnet_ip_range" {
+  description = "IP range of the network subnet shared by dev and prod."
+  type        = string
+}

infra/modules/prod/main.tf

@@ -0,0 +1,106 @@
+# prod: Traefik, Websites, Bitwarden, RustDesk, status page
+
+# Port sources: services/prod/*docker-compose.yml (published ports) and services/todo.md
+# (the documented UFW allow-list).
+resource "hcloud_firewall" "this" {
+  name = "prod-firewall"
+
+  rule { # server ssh
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "22"
+    source_ips = var.allowed_ssh_source_ips
+  }
+
+  rule { # Traefik http/https (Websites, Bitwarden, status page)
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "80"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule {
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "443"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule { # mongo via Traefik tcp entrypoint
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "27017"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule { # rustdesk hbbs
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "21115"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule {
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "21116"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule {
+    direction  = "in"
+    protocol   = "udp"
+    port       = "21116"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule { # rustdesk hbbr
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "21117"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule {
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "21119"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule { # traffic from dev over the private network
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "1-65535"
+    source_ips = [var.network_ip_range]
+  }
+
+  rule {
+    direction  = "in"
+    protocol   = "udp"
+    port       = "1-65535"
+    source_ips = [var.network_ip_range]
+  }
+}
+
+resource "hcloud_server" "this" {
+  name         = "prod"
+  server_type  = var.server_type
+  image        = var.image
+  location     = var.location
+  ssh_keys     = [var.ssh_key_id]
+  firewall_ids = [hcloud_firewall.this.id]
+
+  network {
+    network_id = var.network_id
+    ip         = var.private_ip
+  }
+}
+
+resource "hcloud_volume" "storage" {
+  name      = "prod-storage"
+  size      = var.volume_size
+  server_id = hcloud_server.this.id
+  automount = true
+  format    = "ext4"
+}

infra/modules/prod/outputs.tf

@@ -0,0 +1,7 @@
+output "ipv4" {
+  value = hcloud_server.this.ipv4_address
+}
+
+output "private_ipv4" {
+  value = var.private_ip
+}

infra/modules/prod/variables.tf

@@ -0,0 +1,44 @@
+variable "server_type" {
+  description = "Server type for prod (Traefik, Websites, Bitwarden, RustDesk, status page)."
+  type        = string
+}
+
+variable "image" {
+  description = "OS image used for the server."
+  type        = string
+}
+
+variable "location" {
+  description = "Hetzner Cloud datacenter location."
+  type        = string
+}
+
+variable "ssh_key_id" {
+  description = "ID of the Hetzner Cloud SSH key to install on the server."
+  type        = string
+}
+
+variable "network_id" {
+  description = "ID of the private network to attach prod to."
+  type        = string
+}
+
+variable "private_ip" {
+  description = "Private network IP for prod."
+  type        = string
+}
+
+variable "volume_size" {
+  description = "Size in GB of the volume attached to prod (disk1 in docs/architecture.md)."
+  type        = number
+}
+
+variable "allowed_ssh_source_ips" {
+  description = "CIDRs allowed to reach port 22 on prod."
+  type        = list(string)
+}
+
+variable "network_ip_range" {
+  description = "CIDR of the private network, allowed through the firewall for traffic from dev."
+  type        = string
+}

infra/modules/vpn/main.tf

@@ -0,0 +1,41 @@
+# vpn: OpenVPN + Traefik. Not attached to the private network (see docs/architecture.md).
+resource "hcloud_firewall" "this" {
+  name = "vpn-firewall"
+
+  rule { # server ssh
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "22"
+    source_ips = var.allowed_ssh_source_ips
+  }
+
+  rule { # Traefik http/https (traefik.vpn.luke-else.co.uk)
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "80"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule {
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "443"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule { # OpenVPN tunnel - always direct to this server's public IP, never via a load balancer
+    direction  = "in"
+    protocol   = "udp"
+    port       = "1194"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+}
+
+resource "hcloud_server" "this" {
+  name         = "vpn"
+  server_type  = var.server_type
+  image        = var.image
+  location     = var.location
+  ssh_keys     = [var.ssh_key_id]
+  firewall_ids = [hcloud_firewall.this.id]
+}

infra/modules/vpn/outputs.tf

@@ -0,0 +1,3 @@
+output "ipv4" {
+  value = hcloud_server.this.ipv4_address
+}

infra/modules/vpn/variables.tf

@@ -0,0 +1,24 @@
+variable "server_type" {
+  description = "Server type for vpn (OpenVPN + Traefik)."
+  type        = string
+}
+
+variable "image" {
+  description = "OS image used for the server."
+  type        = string
+}
+
+variable "location" {
+  description = "Hetzner Cloud datacenter location."
+  type        = string
+}
+
+variable "ssh_key_id" {
+  description = "ID of the Hetzner Cloud SSH key to install on the server."
+  type        = string
+}
+
+variable "allowed_ssh_source_ips" {
+  description = "CIDRs allowed to reach port 22 on vpn."
+  type        = list(string)
+}