115 lines
2.7 KiB
Terraform
115 lines
2.7 KiB
Terraform
# prod: Traefik, Websites, Bitwarden, RustDesk, status page
|
|
|
|
# Port sources: services/prod/*docker-compose.yml (published ports) and services/todo.md
|
|
# (the documented UFW allow-list).
|
|
resource "hcloud_firewall" "this" {
|
|
name = "prod-firewall"
|
|
|
|
rule { # server ssh - wired to the vpn server's public IP only, see infra/main.tf
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "22"
|
|
source_ips = var.allowed_ssh_source_ips
|
|
}
|
|
|
|
rule { # Traefik http/https (Websites, Bitwarden, status page)
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "80"
|
|
source_ips = ["0.0.0.0/0", "::/0"]
|
|
}
|
|
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "443"
|
|
source_ips = ["0.0.0.0/0", "::/0"]
|
|
}
|
|
|
|
rule { # rustdesk hbbs
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "21115"
|
|
source_ips = ["0.0.0.0/0", "::/0"]
|
|
}
|
|
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "21116"
|
|
source_ips = ["0.0.0.0/0", "::/0"]
|
|
}
|
|
|
|
rule {
|
|
direction = "in"
|
|
protocol = "udp"
|
|
port = "21116"
|
|
source_ips = ["0.0.0.0/0", "::/0"]
|
|
}
|
|
|
|
rule { # rustdesk hbbr
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "21117"
|
|
source_ips = ["0.0.0.0/0", "::/0"]
|
|
}
|
|
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "21119"
|
|
source_ips = ["0.0.0.0/0", "::/0"]
|
|
}
|
|
|
|
rule { # traffic from dev over the private network
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "1-65535"
|
|
source_ips = [var.network_ip_range]
|
|
}
|
|
|
|
rule {
|
|
direction = "in"
|
|
protocol = "udp"
|
|
port = "1-65535"
|
|
source_ips = [var.network_ip_range]
|
|
}
|
|
}
|
|
|
|
resource "hcloud_server" "this" {
|
|
name = "prod"
|
|
server_type = var.server_type
|
|
image = var.image
|
|
location = var.location
|
|
ssh_keys = var.ssh_key_ids
|
|
firewall_ids = [hcloud_firewall.this.id]
|
|
labels = { role = "prod" } # picked up by ansible/inventory/hcloud.yml
|
|
|
|
network {
|
|
network_id = var.network_id
|
|
ip = var.private_ip
|
|
}
|
|
}
|
|
|
|
resource "hcloud_volume" "storage" {
|
|
name = "prod-storage"
|
|
size = var.volume_size
|
|
server_id = hcloud_server.this.id
|
|
automount = true
|
|
format = "ext4"
|
|
|
|
lifecycle {
|
|
prevent_destroy = true
|
|
}
|
|
}
|
|
|
|
locals {
|
|
# Hetzner's automount convention (hc-utils' 99-hc-volume-automount.rules) is
|
|
# always /mnt/HC_Volume_<id> - deterministic once the volume exists, since the
|
|
# id is stable for the volume's lifetime regardless of which server it's
|
|
# attached to. Kept here only as a human-readable output (see outputs.tf) -
|
|
# ansible/roles/deploy looks this up itself from the Hetzner API, it doesn't
|
|
# read this value.
|
|
data_dir = "/mnt/HC_Volume_${hcloud_volume.storage.id}"
|
|
}
|