# prod: Traefik, Websites, Bitwarden, RustDesk, status page

# Port sources: services/prod/*docker-compose.yml (published ports) and services/todo.md
# (the documented UFW allow-list).
resource "hcloud_firewall" "this" {
  name = "prod-firewall"

  rule { # server ssh - wired to the vpn server's public IP only, see infra/main.tf
    direction  = "in"
    protocol   = "tcp"
    port       = "22"
    source_ips = var.allowed_ssh_source_ips
  }

  rule { # Traefik http/https (Websites, Bitwarden, status page)
    direction  = "in"
    protocol   = "tcp"
    port       = "80"
    source_ips = ["0.0.0.0/0", "::/0"]
  }

  rule {
    direction  = "in"
    protocol   = "tcp"
    port       = "443"
    source_ips = ["0.0.0.0/0", "::/0"]
  }

  rule { # rustdesk hbbs
    direction  = "in"
    protocol   = "tcp"
    port       = "21115"
    source_ips = ["0.0.0.0/0", "::/0"]
  }

  rule {
    direction  = "in"
    protocol   = "tcp"
    port       = "21116"
    source_ips = ["0.0.0.0/0", "::/0"]
  }

  rule {
    direction  = "in"
    protocol   = "udp"
    port       = "21116"
    source_ips = ["0.0.0.0/0", "::/0"]
  }

  rule { # rustdesk hbbr
    direction  = "in"
    protocol   = "tcp"
    port       = "21117"
    source_ips = ["0.0.0.0/0", "::/0"]
  }

  rule {
    direction  = "in"
    protocol   = "tcp"
    port       = "21119"
    source_ips = ["0.0.0.0/0", "::/0"]
  }

  rule { # traffic from dev over the private network
    direction  = "in"
    protocol   = "tcp"
    port       = "1-65535"
    source_ips = [var.network_ip_range]
  }

  rule {
    direction  = "in"
    protocol   = "udp"
    port       = "1-65535"
    source_ips = [var.network_ip_range]
  }
}

resource "hcloud_server" "this" {
  name         = "prod"
  server_type  = var.server_type
  image        = var.image
  location     = var.location
  ssh_keys     = var.ssh_key_ids
  firewall_ids = [hcloud_firewall.this.id]
  labels       = { role = "prod" } # picked up by ansible/inventory/hcloud.yml

  network {
    network_id = var.network_id
    ip         = var.private_ip
  }
}

resource "hcloud_volume" "storage" {
  name      = "prod-storage"
  size      = var.volume_size
  server_id = hcloud_server.this.id
  automount = true
  format    = "ext4"

  lifecycle {
    prevent_destroy = true
  }
}

locals {
  # Hetzner's automount convention (hc-utils' 99-hc-volume-automount.rules) is
  # always /mnt/HC_Volume_<id> - deterministic once the volume exists, since the
  # id is stable for the volume's lifetime regardless of which server it's
  # attached to. Kept here only as a human-readable output (see outputs.tf) -
  # ansible/roles/deploy looks this up itself from the Hetzner API, it doesn't
  # read this value.
  data_dir = "/mnt/HC_Volume_${hcloud_volume.storage.id}"
}