luke-else/server
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Feat/open tofu #8

Merged
luke-else merged 24 commits from feat/open-tofu into main 2026-07-22 00:10:01 +00:00
Conversation 0 Commits 24 Files Changed 83
+473 -230
19 changed files with 473 additions and 230 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit a7cfcc33ce - Show all commits
infra/.terraform.lock.hcl
Generated
+32
View File
@@ -1,6 +1,38 @@
# This file is maintained automatically by "tofu init".
# Manual edits may be lost in future updates.
provider "registry.opentofu.org/hashicorp/hcloud" {
version = "1.66.0"
hashes = [
"h1:+R3t/5wqCb2ics5bNZ4JgtfaAa08Z6uRzXzNtwovVEY=",
"h1:9c1ECk3N9xhdQKz4NVCfYEFxebJVVeQZS3E6wrR/Hx8=",
"h1:EtYB/KjPN2cIJa6hpEaVc8q/3yf6e9IT6/uAybUGqps=",
"h1:GUupu6Fg5zFY9i4/3esiy8uHZnUrt+u2B6NaE4+8YqQ=",
"h1:JHehRJySEFRGYK+D6pFS0MTTDDRlGSQdSaKdEo0AemA=",
"h1:XF+SwyO1ttQJ0WXJ5O628O7cGk9U37sGn0o3LwWUnDQ=",
"h1:czuvCXAd8CcszXh3k3E0N6tFfQkYSNbKXo99LG+yOIc=",
"h1:dPIwO6zTxYs6bHn5yf/w/1AExaHPppCLyTrWrdzH4RE=",
"h1:gqrhnYuIBzpUvgWHITNRUMLaDcKACGlrNfrbtbtO7KY=",
"h1:iVAGP8gRbZK0kJF7SiYJRt61wz0D5AF9q+WMsrAiBI0=",
"h1:kLi29SbGCU/Z/Ch0zuNdYFSKP3mHp8zfcOpZsIN/KIQ=",
"h1:mq2+1Q/5gWJYI8XOXQCeteUg0AP7VezPOGOjkkHRQso=",
"h1:rnWTWAOlJhHtD3kkU4Qfw0bg9ko/dlH822inxYLBmfQ=",
"zh:1286cee6fb63dbcb18f53077bbb5e5d132a4e4d9f006af4e8d8edfc08d6bcdc8",
"zh:204460dacc044bda019a4a18b398e094289500c36913c7c9457f432adf31b8b2",
"zh:214175d50773481cbeaf9c9004e4121a3a1c9686c79424ebdc8ff189dd057d3e",
"zh:22b17bceff61cc13ad04a399ba87521356a3a134d4687273727473ae9eccf5f1",
"zh:368867dac5525c411de7e38f2e27de0a71854d1750867322ff2b9321128c88fb",
"zh:5289b75f8370bdbc4c6051d55cf33d0b1bd25dc6d71bfbd39b360249a37f1501",
"zh:81cb676aa50c5777df8fc80d4e69c9012330ae751f5e6f12bf6074bfd2e7c496",
"zh:ab08aead10643b21aa6b51af562b50492e12b9dd0ab7dca27a05aa63209b7d66",
"zh:af25c210d0570cf61ef767b2545bf9f3fb909178135f0e5e14bec0c1c9d07a63",
"zh:bcad66f4830c97118fa793723e53f8a4d27ddd34ea969ff259408842c2238331",
"zh:ce3ed323d75ae905d975925fa98c7054a7514c81276a485fc37da8232b53e39f",
"zh:d481bc0ef0c87ab1969c17777f526b2f59f823432d676145134c41a6d29bd98e",
"zh:ea7ef88df2c3ca154d86238920636d52a3c9066c7467543d3fa45f1e52ec2f7b",
]
}
provider "registry.opentofu.org/hetznercloud/hcloud" {
version = "1.66.0"
constraints = "~> 1.45"
infra/firewalls.tf
-155
View File
@@ -1,155 +0,0 @@
# Port sources: services/*/docker-compose.yml (published ports) and services/todo.md
# (the documented UFW allow-list). dev has no firewall in architecture.md, but we add
# one anyway for baseline safety - see conversation history.
resource "hcloud_firewall" "dev" {
name = "dev-firewall"
rule { # server ssh
direction = "in"
protocol = "tcp"
port = "22"
source_ips = var.allowed_ssh_source_ips
}
rule { # gitea ssh (git.luke-else.co.uk, published as 222:22)
direction = "in"
protocol = "tcp"
port = "222"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule { # TraefikRunner http/https (git.luke-else.co.uk, cicd.luke-else.co.uk)
direction = "in"
protocol = "tcp"
port = "80"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule {
direction = "in"
protocol = "tcp"
port = "443"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule { # traffic from prod over the private network
direction = "in"
protocol = "tcp"
port = "1-65535"
source_ips = [var.network_ip_range]
}
rule {
direction = "in"
protocol = "udp"
port = "1-65535"
source_ips = [var.network_ip_range]
}
}
resource "hcloud_firewall" "prod" {
name = "prod-firewall"
rule { # server ssh
direction = "in"
protocol = "tcp"
port = "22"
source_ips = var.allowed_ssh_source_ips
}
rule { # Traefik http/https (Websites, Bitwarden, Misc, Tracking)
direction = "in"
protocol = "tcp"
port = "80"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule {
direction = "in"
protocol = "tcp"
port = "443"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule { # rustdesk hbbs
direction = "in"
protocol = "tcp"
port = "21115"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule {
direction = "in"
protocol = "tcp"
port = "21116"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule {
direction = "in"
protocol = "udp"
port = "21116"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule { # rustdesk hbbr
direction = "in"
protocol = "tcp"
port = "21117"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule {
direction = "in"
protocol = "tcp"
port = "21119"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule { # traffic from dev over the private network
direction = "in"
protocol = "tcp"
port = "1-65535"
source_ips = [var.network_ip_range]
}
rule {
direction = "in"
protocol = "udp"
port = "1-65535"
source_ips = [var.network_ip_range]
}
}
resource "hcloud_firewall" "vpn" {
name = "vpn-firewall"
rule { # server ssh
direction = "in"
protocol = "tcp"
port = "22"
source_ips = var.allowed_ssh_source_ips
}
rule { # TraefikVPN http/https (traefik.vpn.luke-else.co.uk)
direction = "in"
protocol = "tcp"
port = "80"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule {
direction = "in"
protocol = "tcp"
port = "443"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule { # OpenVPN tunnel - always direct to this server's public IP, never via a load balancer
direction = "in"
protocol = "udp"
port = "1194"
source_ips = ["0.0.0.0/0", "::/0"]
}
}
infra/main.tf
+55
View File
@@ -0,0 +1,55 @@
# Root module: wires together the shared network and the three host modules
# (one per server in docs/architecture.md). Each host module owns its own
# firewall (and volume, where applicable) - see modules/<host>/main.tf.
module "network" {
source = "./modules/network"
ip_range = var.network_ip_range
network_zone = var.network_zone
subnet_ip_range = var.subnet_ip_range
}
module "dev" {
source = "./modules/dev"
server_type = var.dev_server_type
image = var.server_image
location = var.location
ssh_key_id = data.hcloud_ssh_key.main.id
network_id = module.network.id
private_ip = var.dev_private_ip
volume_size = var.dev_volume_size
allowed_ssh_source_ips = var.allowed_ssh_source_ips
network_ip_range = var.network_ip_range
# module.network.id alone doesn't guarantee the subnet exists yet, and a server
# can't join a network before it has a subnet.
depends_on = [module.network]
}
module "prod" {
source = "./modules/prod"
server_type = var.prod_server_type
image = var.server_image
location = var.location
ssh_key_id = data.hcloud_ssh_key.main.id
network_id = module.network.id
private_ip = var.prod_private_ip
volume_size = var.prod_volume_size
allowed_ssh_source_ips = var.allowed_ssh_source_ips
network_ip_range = var.network_ip_range
depends_on = [module.network]
}
module "vpn" {
source = "./modules/vpn"
server_type = var.vpn_server_type
image = var.server_image
location = var.location
ssh_key_id = data.hcloud_ssh_key.main.id
allowed_ssh_source_ips = var.allowed_ssh_source_ips
}
infra/modules/dev/main.tf
+72
View File
@@ -0,0 +1,72 @@
# dev: Gitea + Runner + Traefik (git.luke-else.co.uk, cicd.luke-else.co.uk)
# Port sources: services/dev/*docker-compose.yml (published ports) and services/todo.md
# (the documented UFW allow-list). dev has no firewall in docs/architecture.md, but we
# add one anyway for baseline safety - see conversation history.
resource "hcloud_firewall" "this" {
name = "dev-firewall"
rule { # server ssh
direction = "in"
protocol = "tcp"
port = "22"
source_ips = var.allowed_ssh_source_ips
}
rule { # gitea ssh (git.luke-else.co.uk, published as 222:22)
direction = "in"
protocol = "tcp"
port = "222"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule { # Traefik http/https (git.luke-else.co.uk, cicd.luke-else.co.uk)
direction = "in"
protocol = "tcp"
port = "80"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule {
direction = "in"
protocol = "tcp"
port = "443"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule { # traffic from prod over the private network
direction = "in"
protocol = "tcp"
port = "1-65535"
source_ips = [var.network_ip_range]
}
rule {
direction = "in"
protocol = "udp"
port = "1-65535"
source_ips = [var.network_ip_range]
}
}
resource "hcloud_server" "this" {
name = "dev"
server_type = var.server_type
image = var.image
location = var.location
ssh_keys = [var.ssh_key_id]
firewall_ids = [hcloud_firewall.this.id]
network {
network_id = var.network_id
ip = var.private_ip
}
}
resource "hcloud_volume" "storage" {
name = "dev-storage"
size = var.volume_size
server_id = hcloud_server.this.id
automount = true
format = "ext4"
}
infra/modules/dev/outputs.tf
+7
View File
@@ -0,0 +1,7 @@
output "ipv4" {
value = hcloud_server.this.ipv4_address
}
output "private_ipv4" {
value = var.private_ip
}
infra/modules/dev/variables.tf
+44
View File
@@ -0,0 +1,44 @@
variable "server_type" {
description = "Server type for dev (Gitea + Runner)."
type = string
}
variable "image" {
description = "OS image used for the server."
type = string
}
variable "location" {
description = "Hetzner Cloud datacenter location."
type = string
}
variable "ssh_key_id" {
description = "ID of the Hetzner Cloud SSH key to install on the server."
type = string
}
variable "network_id" {
description = "ID of the private network to attach dev to."
type = string
}
variable "private_ip" {
description = "Private network IP for dev."
type = string
}
variable "volume_size" {
description = "Size in GB of the volume attached to dev (disk2 in docs/architecture.md)."
type = number
}
variable "allowed_ssh_source_ips" {
description = "CIDRs allowed to reach port 22 on dev."
type = list(string)
}
variable "network_ip_range" {
description = "CIDR of the private network, allowed through the firewall for traffic from prod."
type = string
}
infra/network.tf → infra/modules/network/main.tf
+2 -2
View File
@@ -1,8 +1,8 @@
# Private network shared by dev and prod (see architecture.md "network" group).
# Private network shared by dev and prod (see docs/architecture.md "network" group).
# vpn is intentionally not attached to this network - it sits outside it in the diagram.
resource "hcloud_network" "main" {
name = "server-network"
ip_range = var.network_ip_range
ip_range = var.ip_range
}
resource "hcloud_network_subnet" "main" {
infra/modules/network/outputs.tf
+9
View File
@@ -0,0 +1,9 @@
output "id" {
value = hcloud_network.main.id
}
# Exposed so dependents can depend_on the subnet existing, not just the network -
# attaching a server to a network fails if the network has no subnet yet.
output "subnet_id" {
value = hcloud_network_subnet.main.id
}
infra/modules/network/variables.tf
+14
View File
@@ -0,0 +1,14 @@
variable "ip_range" {
description = "IP range of the private network shared by dev and prod."
type = string
}
variable "network_zone" {
description = "Hetzner Cloud network zone matching var.location."
type = string
}
variable "subnet_ip_range" {
description = "IP range of the network subnet shared by dev and prod."
type = string
}
infra/modules/prod/main.tf
+106
View File
@@ -0,0 +1,106 @@
# prod: Traefik, Websites, Bitwarden, RustDesk, status page
# Port sources: services/prod/*docker-compose.yml (published ports) and services/todo.md
# (the documented UFW allow-list).
resource "hcloud_firewall" "this" {
name = "prod-firewall"
rule { # server ssh
direction = "in"
protocol = "tcp"
port = "22"
source_ips = var.allowed_ssh_source_ips
}
rule { # Traefik http/https (Websites, Bitwarden, status page)
direction = "in"
protocol = "tcp"
port = "80"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule {
direction = "in"
protocol = "tcp"
port = "443"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule { # mongo via Traefik tcp entrypoint
direction = "in"
protocol = "tcp"
port = "27017"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule { # rustdesk hbbs
direction = "in"
protocol = "tcp"
port = "21115"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule {
direction = "in"
protocol = "tcp"
port = "21116"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule {
direction = "in"
protocol = "udp"
port = "21116"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule { # rustdesk hbbr
direction = "in"
protocol = "tcp"
port = "21117"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule {
direction = "in"
protocol = "tcp"
port = "21119"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule { # traffic from dev over the private network
direction = "in"
protocol = "tcp"
port = "1-65535"
source_ips = [var.network_ip_range]
}
rule {
direction = "in"
protocol = "udp"
port = "1-65535"
source_ips = [var.network_ip_range]
}
}
resource "hcloud_server" "this" {
name = "prod"
server_type = var.server_type
image = var.image
location = var.location
ssh_keys = [var.ssh_key_id]
firewall_ids = [hcloud_firewall.this.id]
network {
network_id = var.network_id
ip = var.private_ip
}
}
resource "hcloud_volume" "storage" {
name = "prod-storage"
size = var.volume_size
server_id = hcloud_server.this.id
automount = true
format = "ext4"
}
infra/modules/prod/outputs.tf
+7
View File
@@ -0,0 +1,7 @@
output "ipv4" {
value = hcloud_server.this.ipv4_address
}
output "private_ipv4" {
value = var.private_ip
}
infra/modules/prod/variables.tf
+44
View File
@@ -0,0 +1,44 @@
variable "server_type" {
description = "Server type for prod (Traefik, Websites, Bitwarden, RustDesk, status page)."
type = string
}
variable "image" {
description = "OS image used for the server."
type = string
}
variable "location" {
description = "Hetzner Cloud datacenter location."
type = string
}
variable "ssh_key_id" {
description = "ID of the Hetzner Cloud SSH key to install on the server."
type = string
}
variable "network_id" {
description = "ID of the private network to attach prod to."
type = string
}
variable "private_ip" {
description = "Private network IP for prod."
type = string
}
variable "volume_size" {
description = "Size in GB of the volume attached to prod (disk1 in docs/architecture.md)."
type = number
}
variable "allowed_ssh_source_ips" {
description = "CIDRs allowed to reach port 22 on prod."
type = list(string)
}
variable "network_ip_range" {
description = "CIDR of the private network, allowed through the firewall for traffic from dev."
type = string
}
infra/modules/vpn/main.tf
+41
View File
@@ -0,0 +1,41 @@
# vpn: OpenVPN + Traefik. Not attached to the private network (see docs/architecture.md).
resource "hcloud_firewall" "this" {
name = "vpn-firewall"
rule { # server ssh
direction = "in"
protocol = "tcp"
port = "22"
source_ips = var.allowed_ssh_source_ips
}
rule { # Traefik http/https (traefik.vpn.luke-else.co.uk)
direction = "in"
protocol = "tcp"
port = "80"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule {
direction = "in"
protocol = "tcp"
port = "443"
source_ips = ["0.0.0.0/0", "::/0"]
}
rule { # OpenVPN tunnel - always direct to this server's public IP, never via a load balancer
direction = "in"
protocol = "udp"
port = "1194"
source_ips = ["0.0.0.0/0", "::/0"]
}
}
resource "hcloud_server" "this" {
name = "vpn"
server_type = var.server_type
image = var.image
location = var.location
ssh_keys = [var.ssh_key_id]
firewall_ids = [hcloud_firewall.this.id]
}
infra/modules/vpn/outputs.tf
+3
View File
@@ -0,0 +1,3 @@
output "ipv4" {
value = hcloud_server.this.ipv4_address
}
infra/modules/vpn/variables.tf
+24
View File
@@ -0,0 +1,24 @@
variable "server_type" {
description = "Server type for vpn (OpenVPN + Traefik)."
type = string
}
variable "image" {
description = "OS image used for the server."
type = string
}
variable "location" {
description = "Hetzner Cloud datacenter location."
type = string
}
variable "ssh_key_id" {
description = "ID of the Hetzner Cloud SSH key to install on the server."
type = string
}
variable "allowed_ssh_source_ips" {
description = "CIDRs allowed to reach port 22 on vpn."
type = list(string)
}
infra/outputs.tf
+5 -5
View File
@@ -1,19 +1,19 @@
output "dev_ipv4" {
value = hcloud_server.dev.ipv4_address
value = module.dev.ipv4
}
output "dev_private_ipv4" {
value = var.dev_private_ip
value = module.dev.private_ipv4
}
output "prod_ipv4" {
value = hcloud_server.prod.ipv4_address
value = module.prod.ipv4
}
output "prod_private_ipv4" {
value = var.prod_private_ip
value = module.prod.private_ipv4
}
output "vpn_ipv4" {
value = hcloud_server.vpn.ipv4_address
value = module.vpn.ipv4
}
infra/servers.tf
-43
View File
@@ -1,43 +0,0 @@
# dev: Gitea + Runner + TraefikRunner (git.luke-else.co.uk, cicd.luke-else.co.uk)
resource "hcloud_server" "dev" {
name = "dev"
server_type = var.dev_server_type
image = var.server_image
location = var.location
ssh_keys = [data.hcloud_ssh_key.main.id]
firewall_ids = [hcloud_firewall.dev.id]
network {
network_id = hcloud_network.main.id
ip = var.dev_private_ip
}
depends_on = [hcloud_network_subnet.main]
}
# prod: Traefik, Websites, Database, Bitwarden, Misc, Tracking, Rustdesk
resource "hcloud_server" "prod" {
name = "prod"
server_type = var.prod_server_type
image = var.server_image
location = var.location
ssh_keys = [data.hcloud_ssh_key.main.id]
firewall_ids = [hcloud_firewall.prod.id]
network {
network_id = hcloud_network.main.id
ip = var.prod_private_ip
}
depends_on = [hcloud_network_subnet.main]
}
# vpn: OpenVPN + TraefikVPN. Not attached to the private network (see architecture.md).
resource "hcloud_server" "vpn" {
name = "vpn"
server_type = var.vpn_server_type
image = var.server_image
location = var.location
ssh_keys = [data.hcloud_ssh_key.main.id]
firewall_ids = [hcloud_firewall.vpn.id]
}
infra/variables.tf
+8 -8
View File
@@ -17,33 +17,33 @@ variable "server_image" {
}
variable "dev_server_type" {
description = "Server type for dev (Gitea + Runner)."
description = "Server type for dev"
type = string
default = "cx22"
}
variable "prod_server_type" {
description = "Server type for prod (Traefik, Websites, Database, Bitwarden, Misc, Tracking, Rustdesk)."
description = "Server type for prod"
type = string
default = "cx32"
default = "cx22"
}
variable "vpn_server_type" {
description = "Server type for vpn (OpenVPN + TraefikVPN)."
description = "Server type for vpn"
type = string
default = "cx22"
}
variable "dev_volume_size" {
description = "Size in GB of the volume attached to dev (disk2 in architecture.md)."
description = "Size in GB of the volume attached to dev"
type = number
default = 50
default = 20
}
variable "prod_volume_size" {
description = "Size in GB of the volume attached to prod (disk1 in architecture.md)."
description = "Size in GB of the volume attached to prod (disk1 in docs/architecture.md)."
type = number
default = 50
default = 20
}
variable "network_ip_range" {
infra/volumes.tf
-17
View File
@@ -1,17 +0,0 @@
# disk1 in architecture.md - attached to prod
resource "hcloud_volume" "prod_storage" {
name = "prod-storage"
size = var.prod_volume_size
server_id = hcloud_server.prod.id
automount = true
format = "ext4"
}
# disk2 in architecture.md - attached to dev
resource "hcloud_volume" "dev_storage" {
name = "dev-storage"
size = var.dev_volume_size
server_id = hcloud_server.dev.id
automount = true
format = "ext4"
}