feat: Created post-install script

infra/main.tf

@@ -2,6 +2,20 @@
 # (one per server in docs/architecture.md). Each host module owns its own
 # firewall (and volume, where applicable) - see modules/<host>/main.tf.
 
+locals {
+  # SSH to dev/prod is only permitted from the vpn server's public IP: admins must
+  # tunnel through the VPN first, whose egress traffic is then sourced from this IP.
+  # vpn itself can't require tunneling through itself, so it keeps
+  # var.allowed_ssh_source_ips for direct SSH access.
+  vpn_ssh_source_ips = ["${module.vpn.ipv4}/32"]
+
+  # Rendered once and uploaded+run by every host module immediately after its
+  # server is created - see scripts/bootstrap.sh.tftpl.
+  bootstrap_script = templatefile("${path.module}/scripts/bootstrap.sh.tftpl", {
+    deploy_user = var.deploy_user
+  })
+}
+
 module "network" {
   source = "./modules/network"
 
@@ -20,8 +34,10 @@ module "dev" {
   network_id             = module.network.id
   private_ip             = var.dev_private_ip
   volume_size            = var.dev_volume_size
-  allowed_ssh_source_ips = var.allowed_ssh_source_ips
+  allowed_ssh_source_ips = local.vpn_ssh_source_ips
   network_ip_range       = var.network_ip_range
+  bootstrap_script       = local.bootstrap_script
+  ssh_private_key_path   = var.ssh_private_key_path
 
   # module.network.id alone doesn't guarantee the subnet exists yet, and a server
   # can't join a network before it has a subnet.
@@ -38,8 +54,10 @@ module "prod" {
   network_id             = module.network.id
   private_ip             = var.prod_private_ip
   volume_size            = var.prod_volume_size
-  allowed_ssh_source_ips = var.allowed_ssh_source_ips
+  allowed_ssh_source_ips = local.vpn_ssh_source_ips
   network_ip_range       = var.network_ip_range
+  bootstrap_script       = local.bootstrap_script
+  ssh_private_key_path   = var.ssh_private_key_path
 
   depends_on = [module.network]
 }
@@ -52,4 +70,6 @@ module "vpn" {
   location               = var.location
   ssh_key_id             = data.hcloud_ssh_key.main.id
   allowed_ssh_source_ips = var.allowed_ssh_source_ips
+  bootstrap_script       = local.bootstrap_script
+  ssh_private_key_path   = var.ssh_private_key_path
 }