feat: Created post-install script

2026-07-10 21:28:32 +01:00
parent 242e8aa359
commit d4167d5d60
10 changed files with 183 additions and 10 deletions
@@ -76,7 +76,18 @@ variable "ssh_key_name" {
 }

 variable "allowed_ssh_source_ips" {
-  description = "CIDRs allowed to reach port 22 on every server. Narrow this to your own IP(s) once known."
+  description = "CIDRs allowed to reach port 22 on the vpn server. Narrow this to your own IP(s) once known. dev and prod don't use this - their SSH is restricted to the vpn server's own public IP instead (see infra/main.tf)."
  type        = list(string)
  default     = ["0.0.0.0/0", "::/0"]
 }
+
+variable "ssh_private_key_path" {
+  description = "Local path to the private key matching var.ssh_key_name. Used once per server by OpenTofu to upload and run the post-install bootstrap script over SSH immediately after creation (see infra/scripts/bootstrap.sh.tftpl)."
+  type        = string
+}
+
+variable "deploy_user" {
+  description = "Non-root sudo user created on every server by the bootstrap script, with the same SSH key as root."
+  type        = string
+  default     = "deploy"
+}