chore: Restructured infra modules

infra/modules/vpn/main.tf

@@ -0,0 +1,41 @@
+# vpn: OpenVPN + Traefik. Not attached to the private network (see docs/architecture.md).
+resource "hcloud_firewall" "this" {
+  name = "vpn-firewall"
+
+  rule { # server ssh
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "22"
+    source_ips = var.allowed_ssh_source_ips
+  }
+
+  rule { # Traefik http/https (traefik.vpn.luke-else.co.uk)
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "80"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule {
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "443"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule { # OpenVPN tunnel - always direct to this server's public IP, never via a load balancer
+    direction  = "in"
+    protocol   = "udp"
+    port       = "1194"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+}
+
+resource "hcloud_server" "this" {
+  name         = "vpn"
+  server_type  = var.server_type
+  image        = var.image
+  location     = var.location
+  ssh_keys     = [var.ssh_key_id]
+  firewall_ids = [hcloud_firewall.this.id]
+}

infra/modules/vpn/outputs.tf

@@ -0,0 +1,3 @@
+output "ipv4" {
+  value = hcloud_server.this.ipv4_address
+}

infra/modules/vpn/variables.tf

@@ -0,0 +1,24 @@
+variable "server_type" {
+  description = "Server type for vpn (OpenVPN + Traefik)."
+  type        = string
+}
+
+variable "image" {
+  description = "OS image used for the server."
+  type        = string
+}
+
+variable "location" {
+  description = "Hetzner Cloud datacenter location."
+  type        = string
+}
+
+variable "ssh_key_id" {
+  description = "ID of the Hetzner Cloud SSH key to install on the server."
+  type        = string
+}
+
+variable "allowed_ssh_source_ips" {
+  description = "CIDRs allowed to reach port 22 on vpn."
+  type        = list(string)
+}