chore: Restructured infra modules

2026-07-10 20:54:22 +01:00
parent d0d1385bf4
commit a7cfcc33ce
19 changed files with 473 additions and 230 deletions
@@ -0,0 +1,41 @@
+# vpn: OpenVPN + Traefik. Not attached to the private network (see docs/architecture.md).
+resource "hcloud_firewall" "this" {
+  name = "vpn-firewall"
+
+  rule { # server ssh
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "22"
+    source_ips = var.allowed_ssh_source_ips
+  }
+
+  rule { # Traefik http/https (traefik.vpn.luke-else.co.uk)
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "80"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule {
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "443"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule { # OpenVPN tunnel - always direct to this server's public IP, never via a load balancer
+    direction  = "in"
+    protocol   = "udp"
+    port       = "1194"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+}
+
+resource "hcloud_server" "this" {
+  name         = "vpn"
+  server_type  = var.server_type
+  image        = var.image
+  location     = var.location
+  ssh_keys     = [var.ssh_key_id]
+  firewall_ids = [hcloud_firewall.this.id]
+}