feat: Changed openvpn for wireguard

infra/modules/dns/main.tf

@@ -5,13 +5,8 @@
 resource "hcloud_zone" "this" {
   for_each = toset(var.zone_names)
 
-  name              = each.value
-  mode              = "primary"
-  delete_protection = true # API-level guard, in addition to prevent_destroy below
-
-  lifecycle {
-    prevent_destroy = true
-  }
+  name = each.value
+  mode = "primary"
 }
 
 locals {

infra/modules/vpn/main.tf

@@ -1,4 +1,4 @@
-# vpn: OpenVPN + Traefik. Not attached to the private network (see docs/architecture.md).
+# vpn: WireGuard (wg-easy) + Traefik. Not attached to the private network (see docs/architecture.md).
 resource "hcloud_firewall" "this" {
   name = "vpn-firewall"
 
@@ -23,10 +23,10 @@ resource "hcloud_firewall" "this" {
     source_ips = ["0.0.0.0/0", "::/0"]
   }
 
-  rule { # OpenVPN tunnel - always direct to this server's public IP, never via a load balancer
+  rule { # WireGuard tunnel - always direct to this server's public IP, never via a load balancer
     direction  = "in"
     protocol   = "udp"
-    port       = "1194"
+    port       = "51820"
     source_ips = ["0.0.0.0/0", "::/0"]
   }
 }

infra/modules/vpn/variables.tf

@@ -1,5 +1,5 @@
 variable "server_type" {
-  description = "Server type for vpn (OpenVPN + Traefik)."
+  description = "Server type for vpn (WireGuard/wg-easy + Traefik)."
   type        = string
 }