chore: Restructured infra modules

2026-07-10 20:54:22 +01:00
parent d0d1385bf4
commit a7cfcc33ce
19 changed files with 473 additions and 230 deletions
@@ -0,0 +1,106 @@
+# prod: Traefik, Websites, Bitwarden, RustDesk, status page
+
+# Port sources: services/prod/*docker-compose.yml (published ports) and services/todo.md
+# (the documented UFW allow-list).
+resource "hcloud_firewall" "this" {
+  name = "prod-firewall"
+
+  rule { # server ssh
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "22"
+    source_ips = var.allowed_ssh_source_ips
+  }
+
+  rule { # Traefik http/https (Websites, Bitwarden, status page)
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "80"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule {
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "443"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule { # mongo via Traefik tcp entrypoint
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "27017"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule { # rustdesk hbbs
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "21115"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule {
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "21116"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule {
+    direction  = "in"
+    protocol   = "udp"
+    port       = "21116"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule { # rustdesk hbbr
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "21117"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule {
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "21119"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule { # traffic from dev over the private network
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "1-65535"
+    source_ips = [var.network_ip_range]
+  }
+
+  rule {
+    direction  = "in"
+    protocol   = "udp"
+    port       = "1-65535"
+    source_ips = [var.network_ip_range]
+  }
+}
+
+resource "hcloud_server" "this" {
+  name         = "prod"
+  server_type  = var.server_type
+  image        = var.image
+  location     = var.location
+  ssh_keys     = [var.ssh_key_id]
+  firewall_ids = [hcloud_firewall.this.id]
+
+  network {
+    network_id = var.network_id
+    ip         = var.private_ip
+  }
+}
+
+resource "hcloud_volume" "storage" {
+  name      = "prod-storage"
+  size      = var.volume_size
+  server_id = hcloud_server.this.id
+  automount = true
+  format    = "ext4"
+}